VendorsUCMS Projectucms1.4.7
Vulnerabilities

UCMS Project Ucms 1.4.7

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

9CVEs
CVE-2018-20599
UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action.
Published 2018-12-30 · Modified
8.8EPSS 0.015
CVE-2019-12251
sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter.
Published 2019-05-21 · Modified
8.8EPSS 0.012
CVE-2018-19437
UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrary cookie values that are set and not empty.
Published 2018-11-22 · Modified
8.8EPSS 0.011
CVE-2018-20598
UCMS 1.4.7 has ?do=user_addpost CSRF.
Published 2018-12-30 · Modified
8.8EPSS 0.005
CVE-2018-20600
sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.
Published 2018-12-30 · Modified
6.1EPSS 0.007
CVE-2023-5015
UCMS cross site scripting
Published 2023-09-17 · Modified
6.1EPSS 0.005
CVE-2020-20781
A stored cross-site scripting (XSS) vulnerability in /ucms/index.php?do=list_edit of UCMS 1.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the title, key words, description or content text fields.
Published 2021-09-29 · Modified
5.4EPSS 0.005
CVE-2018-20601
UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.
Published 2018-12-30 · Modified
4.8EPSS 0.006
CVE-2018-20597
UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.
Published 2018-12-30 · Modified
4.8EPSS 0.006