CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2018-17037 |
| 高危8.8 |
user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3. |
| 14/09/2018 |
| CVE-2018-17036 | 严重9.8 | An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php. | 14/09/2018 |
| CVE-2018-17035 | 严重9.8 | UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter. | 14/09/2018 |
| CVE-2018-17034 | 中危6.1 | UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter. | 14/09/2018 |