A vulnerability classified as critical was found in QiboSoft QiboCMS X1 up to 1.0.6. Affected by this vulnerability is the function rmb_pay of the file /application/index/controller/Pay.php. The manipulation of the argument callback_class leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252847. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Max CVSS
9.8
EPSS Score
0.06%
Published
2024-02-05
Updated
2024-03-21
Qibosoft QiboCMS v7 was discovered to contain a remote code execution (RCE) vulnerability via the Get_Title function at label_set_rs.php
Max CVSS
8.8
EPSS Score
0.19%
Published
2023-03-16
Updated
2023-03-22
A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0. An attacker is able execute arbitrary PHP code via exploitation of client_upgrade_edition.php and Upgrade.php.
Max CVSS
7.2
EPSS Score
0.12%
Published
2021-05-21
Updated
2021-06-03
Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.
Max CVSS
5.4
EPSS Score
0.06%
Published
2021-12-27
Updated
2022-01-03
A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts.
Max CVSS
8.8
EPSS Score
0.10%
Published
2021-12-27
Updated
2022-01-07
An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.
Max CVSS
9.1
EPSS Score
0.19%
Published
2021-12-27
Updated
2022-10-05
A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL.
Max CVSS
4.3
EPSS Score
0.06%
Published
2021-12-27
Updated
2022-01-06
Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd and starttijd parameters of do/search.php.
Max CVSS
6.1
EPSS Score
0.06%
Published
2023-08-03
Updated
2023-08-05
Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component.
Max CVSS
6.1
EPSS Score
0.12%
Published
2021-04-28
Updated
2021-05-10
qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in the content parameter.
Max CVSS
9.8
EPSS Score
2.57%
Published
2019-10-15
Updated
2019-10-18
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file.
Max CVSS
7.5
EPSS Score
0.26%
Published
2019-01-08
Updated
2019-02-04
qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.
Max CVSS
8.8
EPSS Score
0.11%
Published
2018-10-09
Updated
2018-11-27
SQL injection vulnerability in member/list.php in qibosoft Qi Bo CMS 7 allows remote attackers to execute arbitrary SQL commands via the aidDB[] parameter.
Max CVSS
6.8
EPSS Score
0.14%
Published
2011-02-23
Updated
2017-08-17
13 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!