Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (42 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-29661 1 Chshcms 1 Cscms Music Portal System 2024-11-21 7.2 High
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/save.
CVE-2022-29660 1 Chshcms 1 Cscms Music Portal System 2024-11-21 9.8 Critical
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del.
CVE-2022-28552 1 Chshcms 1 Cscms 2024-11-21 8.8 High
Cscms 4.1 is vulnerable to SQL Injection. Log into the background, open the song module, create a new song, delete it to the recycle bin, and SQL injection security problems will occur when emptying the recycle bin.
CVE-2022-27369 1 Chshcms 1 Cscms 2024-11-21 7.2 High
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component news_News.php_hy.
CVE-2022-27368 1 Chshcms 1 Cscms 2024-11-21 7.2 High
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Lists.php_zhuan.
CVE-2022-27367 1 Chshcms 1 Cscms 2024-11-21 7.2 High
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Topic.php_del.
CVE-2022-27366 1 Chshcms 1 Cscms 2024-11-21 7.2 High
Cscms Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the component dance_Dance.php_hy.
CVE-2022-27365 1 Chshcms 1 Cscms 2024-11-21 7.2 High
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Dance.php_del.
CVE-2022-27090 1 Chshcms 1 Cscms 2024-11-21 5.4 Medium
Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter.
CVE-2020-28103 1 Chshcms 1 Cscms 2024-11-21 9.8 Critical
cscms v4.1 allows for SQL injection via the "page_del" function.
CVE-2020-28102 1 Chshcms 1 Cscms 2024-11-21 9.8 Critical
cscms v4.1 allows for SQL injection via the "js_del" function.
CVE-2020-22848 1 Chshcms 1 Cscms 2024-11-21 9.8 Critical
A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands.
CVE-2020-21238 1 Chshcms 1 Cscms 2024-11-21 9.8 Critical
An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
CVE-2019-9598 1 Chshcms 1 Cscms 2024-11-21 N/A
An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds.
CVE-2019-6779 1 Chshcms 1 Cscms 2024-11-21 N/A
Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links.
CVE-2018-17126 1 Chshcms 1 Cscms 2024-11-21 N/A
CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cmd]);# in Web Name to upload\plugins\sys\Install.php.
CVE-2018-17125 1 Chshcms 1 Cscms 2024-11-21 N/A
CScms 4.1 allows arbitrary directory deletion via a dir=..\\ substring to plugins\sys\admin\Plugins.php.
CVE-2018-16732 1 Chshcms 1 Cscms 2024-11-21 N/A
\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.
CVE-2018-16731 1 Chshcms 1 Cscms 2024-11-21 N/A
CScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default filetype list (gif, jpg, png), and then providing a .php pathname within fileurl JSON data.
CVE-2018-16730 1 Chshcms 1 Cscms 2024-11-21 N/A
\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.