Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (22 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2017-12984 1 Phpmywind 1 Phpmywind 2025-04-20 N/A
PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php.
CVE-2020-21060 1 Phpmywind 1 Phpmywind 2025-02-13 8.8 High
SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page.
CVE-2020-21400 1 Phpmywind 1 Phpmywind 2024-12-10 7.2 High
SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modify function.
CVE-2021-39503 1 Phpmywind 1 Phpmywind 2024-11-21 7.2 High
PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without "<, >, ?, =, `,...." In WriteConfig() function, an attacker can inject php code to /include/config.cache.php file.
CVE-2020-19964 1 Phpmywind 1 Phpmywind 2024-11-21 6.5 Medium
A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator account without authentication.
CVE-2020-18886 1 Phpmywind 1 Phpmywind 2024-11-21 7.2 High
Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.
CVE-2020-18885 1 Phpmywind 1 Phpmywind 2024-11-21 7.2 High
Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.
CVE-2020-18230 1 Phpmywind 1 Phpmywind 2024-11-21 4.8 Medium
Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_switchshow" of component " /admin/web_config.php".
CVE-2020-18229 1 Phpmywind 1 Phpmywind 2024-11-21 4.8 Medium
Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_copyright" of component " /admin/web_config.php".
CVE-2019-8435 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header.
CVE-2019-7661 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
An issue was discovered in PHPMyWind 5.5. The method parameter of the data/api/oauth/connect.php page has a reflected Cross-site Scripting (XSS) vulnerability.
CVE-2019-7660 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting (XSS) vulnerability, as demonstrated by admin/login.php.
CVE-2019-7403 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_backup.php?action=import&dopost=deldir&tbname=../ URI.
CVE-2019-7402 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg&#95;qqcode parameter. This can be exploited via CSRF.
CVE-2019-16704 1 Phpmywind 1 Phpmywind 2024-11-21 4.8 Medium
admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.
CVE-2019-16703 1 Phpmywind 1 Phpmywind 2024-11-21 6.1 Medium
admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.
CVE-2018-17134 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field.
CVE-2018-17133 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting.
CVE-2018-17132 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter.
CVE-2018-17131 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.