Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Max CVSS
6.8
EPSS Score
68.88%
Published
2005-01-10
Updated
2017-07-11
parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to gain sensitive information via an invalid file parameter, which reveals the web server's installation path.
Max CVSS
5.0
EPSS Score
0.80%
Published
2005-01-10
Updated
2017-07-11
Directory traversal vulnerability in class.layout_phpcms.php in phpCMS 1.2.x before 1.2.1pl2 allows remote attackers to read or include arbitrary files, as demonstrated using a .. (dot dot) in the language parameter to parser.php.
Max CVSS
5.0
EPSS Score
0.71%
Published
2005-06-02
Updated
2016-10-18
Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in parser/include/ including (1) class.parser_phpcms.php, (2) class.session_phpcms.php, (3) class.edit_phpcms.php, (4) class.http_indexer_phpcms.php, (5) class.cache_phpcms.php, (6) class.search_phpcms.php, (7) class.lib_indexer_universal_phpcms.php, and (8) class.layout_phpcms.php, (9) parser/plugs/counter.php, and (10) parser/parser.php. NOTE: the class.cache_phpcms.php vector was also reported to affect 1.1.7.
Max CVSS
7.5
EPSS Score
33.61%
Published
2006-06-15
Updated
2018-10-18
Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to parser/parser.php, as demonstrated by a filename ending with %00.gif, a different vector than CVE-2005-1840.
Max CVSS
7.8
EPSS Score
1.54%
Published
2008-01-31
Updated
2018-10-15
PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkcode request.
Max CVSS
7.5
EPSS Score
0.21%
Published
2018-08-05
Updated
2019-10-03
A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cache_template/*.tpl.php file along with a "<?php function " substring.
Max CVSS
9.8
EPSS Score
79.20%
Published
2018-11-09
Updated
2019-02-04
PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.
Max CVSS
4.8
EPSS Score
0.07%
Published
2019-03-25
Updated
2019-03-26
SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php.
Max CVSS
9.8
EPSS Score
0.17%
Published
2021-06-16
Updated
2021-06-21
Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword.
Max CVSS
5.3
EPSS Score
0.11%
Published
2021-06-16
Updated
2021-06-17
phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php.
Max CVSS
8.8
EPSS Score
0.11%
Published
2021-06-16
Updated
2022-09-29
SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php.
Max CVSS
9.8
EPSS Score
0.17%
Published
2021-06-16
Updated
2021-06-21
There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.
Max CVSS
6.1
EPSS Score
0.07%
Published
2022-06-15
Updated
2022-06-23
13 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!