CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 14/09/2019 |
| CVE-2019-10708 | 严重9.8 | S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter. | 02/04/2019 |
| CVE-2019-10237 | 高危8.8 | S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040. | 27/03/2019 |
| CVE-2019-9925 | 中危6.1 | S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter. | 22/03/2019 |
| CVE-2019-9040 | 高危8.8 | S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332. | 23/02/2019 |
| CVE-2019-6805 | 严重9.8 | SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O_id parameter. | 25/01/2019 |
| CVE-2018-20480 | 严重9.8 | An issue was discovered in S-CMS 1.0. It allows SQL Injection via the js/pic.php P_id parameter. | 26/12/2018 |
| CVE-2018-20479 | 严重9.8 | An issue was discovered in S-CMS 1.0. It allows SQL Injection via the wap_index.php?type=newsinfo S_id parameter. | 26/12/2018 |
| CVE-2018-20478 | 高危7.5 | An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case extension, as demonstrated by a DownName=download.Php value. | 26/12/2018 |
| CVE-2018-20477 | 严重9.8 | An issue was discovered in S-CMS 3.0. It allows SQL Injection via the bank/callback1.php P_no field. | 26/12/2018 |
| CVE-2018-20476 | 中危6.1 | An issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter. | 26/12/2018 |
| CVE-2018-20018 | 高危7.5 | S-CMS V3.0 has SQL injection via the S_id parameter, as demonstrated by the /1/?type=productinfo&S_id=140 URI. | 10/12/2018 |
| CVE-2018-19332 | 高危8.8 | An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI. | 17/11/2018 |
| CVE-2018-19331 | 高危7.5 | An issue was discovered in S-CMS v1.5. There is a SQL injection vulnerability in search.php via the keyword parameter. | 17/11/2018 |
| CVE-2018-19145 | 中危6.1 | An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter. | 09/11/2018 |
| CVE-2018-18887 | 严重9.8 | S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field). | 01/11/2018 |
| CVE-2018-18427 | 严重9.8 | s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php. | 17/10/2018 |