Filtered by vendor Damicms Subscriptions
Filtered by product Damicms Subscriptions
Total 11 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-20571 1 Damicms 1 Damicms 2022-10-03 N/A
DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=Tpl/Add/id/.\Public\Config\config.ini.php to read the global configuration file.
CVE-2020-21236 1 Damicms 1 Damicms 2022-01-10 8.8 High
A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie.
CVE-2020-18458 1 Damicms 1 Damicms 2021-08-17 8.0 High
Cross Site Request Forgery (CSRF) vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd.
CVE-2020-18451 1 Damicms 1 Damicms 2021-08-13 4.8 Medium
Cross Site Scripting (XSS) vulnerability exists in DamiCMS v6.0.6 via the title parameter in the doadd function in LabelAction.class.php.
CVE-2018-13031 1 Damicms 1 Damicms 2021-06-17 N/A
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account.
CVE-2018-16239 1 Damicms 1 Damicms 2019-10-03 N/A
An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.
CVE-2018-14831 1 Damicms 1 Damicms 2019-07-17 N/A
An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a crafted /admin.php?s=Tpl/Add/id/ URI.
CVE-2018-16331 1 Damicms 1 Damicms 2018-10-23 N/A
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.
CVE-2018-16237 1 Damicms 1 Damicms 2018-10-19 N/A
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI.
CVE-2018-16238 1 Damicms 1 Damicms 2018-10-19 N/A
An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file.
CVE-2018-15844 1 Damicms 1 Damicms 2018-10-17 N/A
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit.