CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 严重9.8 |
LAOBANCMS 2.0 allows install/mysql_hy.php?riqi=../ Directory Traversal. |
| 17/11/2018 |
| CVE-2018-19229 | 中危5.4 | An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter. | 12/11/2018 |
| CVE-2018-19228 | 高危7.5 | An issue was discovered in LAOBANCMS 2.0. It allows arbitrary file deletion via ../ directory traversal in the admin/pic.php del parameter, as demonstrated by deleting install/install.txt to permit a reinstallation. | 12/11/2018 |
| CVE-2018-19227 | 中危5.4 | An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/liuyan.php neirong[] parameter. | 12/11/2018 |
| CVE-2018-19226 | 中危5.3 | An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to list .txt files via a direct request for the /data/0/admin.txt URI. | 12/11/2018 |
| CVE-2018-19225 | 高危8.8 | An issue was discovered in LAOBANCMS 2.0. admin/mima.php has CSRF. | 12/11/2018 |
| CVE-2018-19224 | 高危7.5 | An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies. | 12/11/2018 |
| CVE-2018-19223 | 中危4.8 | An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI. | 12/11/2018 |
| CVE-2018-19222 | 严重9.8 | An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysql_hy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists. | 12/11/2018 |
| CVE-2018-19221 | 严重9.8 | An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter. | 12/11/2018 |
| CVE-2018-19220 | 严重9.8 | An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI. | 12/11/2018 |