CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 22/07/2018 |
| CVE-2018-14389 | 严重9.8 | joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter. | 18/07/2018 |
| CVE-2018-14388 | 中危5.4 | joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter. | 18/07/2018 |
| CVE-2018-14334 | 严重9.8 | manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766. | 17/07/2018 |
| CVE-2018-12905 | 中危6.1 | joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions. | 27/06/2018 |
| CVE-2018-12039 | 严重9.8 | joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring. | 07/06/2018 |
| CVE-2018-10096 | 中危4.8 | joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request. | 13/04/2018 |
| CVE-2018-10073 | 中危4.8 | joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter. | 12/04/2018 |
| CVE-2018-10028 | 中危5.3 | joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI. | 11/04/2018 |
| CVE-2018-8767 | 中危4.8 | joyplus-cms 1.6.0 has XSS in manager/admin_ajax.php?action=save&tab={pre}vod_type via the t_name parameter. | 18/03/2018 |
| CVE-2018-8766 | 严重9.8 | joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=add. | 18/03/2018 |
| CVE-2018-8717 | 高危8.8 | joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request. | 15/03/2018 |