PatchTheCVEcscms vulnerabilities and fixes
Recent CVEs affecting cscms, with upgrade or downgrade steps. 22 tracked.
cscms has 22 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-06-09. Highest priority: CVE-2020-22848 (score 66/100).
- CVE-2022-30898 MEDIUM 6.5 DOWNGRADE A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to
- CVE-2022-28552 HIGH 8.8 DOWNGRADE Cscms 4.1 is vulnerable to SQL Injection
- CVE-2022-27369 HIGH 7.2 DOWNGRADE Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component news_
- CVE-2022-27368 HIGH 7.2 DOWNGRADE Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance
- CVE-2022-27367 HIGH 7.2 DOWNGRADE Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance
- CVE-2022-27366 HIGH 7.2 DOWNGRADE Cscms Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the component
- CVE-2022-27365 HIGH 7.2 DOWNGRADE Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance
- CVE-2022-27090 MEDIUM 5.4 DOWNGRADE Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter
- CVE-2020-28103 CRITICAL 9.8 DOWNGRADE cscms v4.1 allows for SQL injection via the "page_del" function.
- CVE-2020-28102 CRITICAL 9.8 DOWNGRADE cscms v4.1 allows for SQL injection via the "js_del" function.
- CVE-2020-22848 CRITICAL 9.8 DOWNGRADE A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to e
- CVE-2020-21238 CRITICAL 9.8 DOWNGRADE An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
- CVE-2019-9598 MEDIUM 6.5 DOWNGRADE An issue was discovered in Cscms 4.1.0
- CVE-2019-6779 HIGH 8.1 DOWNGRADE Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links.
- CVE-2018-17126 CRITICAL 9.8 DOWNGRADE CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cmd]);# in Web Name to upload\plugi
- CVE-2018-17125 HIGH 7.5 DOWNGRADE CScms 4.1 allows arbitrary directory deletion via a dir=..\\ substring to plugins\sys\admin\Plugins.php.
- CVE-2018-16732 HIGH 8.8 DOWNGRADE \upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.
- CVE-2018-16731 CRITICAL 9.8 DOWNGRADE CScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default filetype list
- CVE-2018-16730 MEDIUM 6.1 DOWNGRADE \upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.
- CVE-2018-16448 HIGH 8.8 DOWNGRADE Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via uploa
- CVE-2018-16337 MEDIUM 6.5 DOWNGRADE An issue was discovered in Cscms V4.1.8
- CVE-2018-11527 HIGH 8.8 DOWNGRADE An issue was discovered in CScms v4.1
FAQ
How do I fix cscms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cscms being exploited right now?
None of the tracked cscms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cscms CVE should I patch first?
CVE-2020-22848 currently ranks highest (66/100): A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to e.