Lylme Spage

An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file.

An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted file.

lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the $userip parameter at function.php.

LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php.

LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.

Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend.

LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.

LyLme Spage ajax_link.php sql injection

LyLme_spage tag.php sql injection

LyLme_spage apply.php sql injection

LyLme_spage sou.php sql injection

LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.