joyplus vulnerabilities and fixes

Recent CVEs affecting joyplus, with upgrade or downgrade steps. 3 tracked.

joyplus has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2019-09-21. Highest priority: CVE-2019-16656 (score 62/100).

• CVE-2019-16660 HIGH 8.8 DOWNGRADE joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.
• CVE-2019-16656 CRITICAL 9.8 DOWNGRADE joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in th
• CVE-2019-16655 HIGH 7.5 DOWNGRADE joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.

FAQ

How do I fix joyplus vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is joyplus being exploited right now?

None of the tracked joyplus CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which joyplus CVE should I patch first?

CVE-2019-16656 currently ranks highest (62/100): joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in th.

RSS feed for joyplus · ← Back to latest CVEs