CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2018-14389 | 심각9.8 | joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter. | 18/07/2018 |
| CVE-2018-14388 | 보통5.4 | joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter. | 18/07/2018 |
| CVE-2018-14334 | 심각9.8 | manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766. | 17/07/2018 |
| CVE-2018-12905 | 보통6.1 | joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions. | 27/06/2018 |
| CVE-2018-12039 | 심각9.8 | joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring. | 07/06/2018 |
| CVE-2018-10096 | 보통4.8 | joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request. | 13/04/2018 |
| CVE-2018-10073 | 보통4.8 | joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter. | 12/04/2018 |
| CVE-2018-10028 | 보통5.3 | joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI. | 11/04/2018 |
| CVE-2018-8767 | 보통4.8 | joyplus-cms 1.6.0 has XSS in manager/admin_ajax.php?action=save&tab={pre}vod_type via the t_name parameter. | 18/03/2018 |
| CVE-2018-8766 | 심각9.8 | joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=add. | 18/03/2018 |
| CVE-2018-8717 | 높음8.8 | joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request. | 15/03/2018 |