https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-18167.htmlhttps://patchthecve.com/cve/CVE-2020-18167.htmlWed, 17 Jun 2026 02:59:12 +0000MEDIUM 4.8: Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu".https://patchthecve.com/cve/CVE-2020-18166.htmlhttps://patchthecve.com/cve/CVE-2020-18166.htmlWed, 17 Jun 2026 02:59:11 +0000CRITICAL 9.8: Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a ".jpg.php" extension to the component "admin/wenjian.php?wj=../templets/pc".https://patchthecve.com/cve/CVE-2020-18165.htmlhttps://patchthecve.com/cve/CVE-2020-18165.htmlWed, 17 Jun 2026 02:59:11 +0000MEDIUM 4.8: Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu".https://patchthecve.com/cve/CVE-2018-19328.htmlhttps://patchthecve.com/cve/CVE-2018-19328.htmlWed, 17 Jun 2026 01:49:08 +0000CRITICAL 9.8: LAOBANCMS 2.0 allows install/mysql_hy.php?riqi=../ Directory Traversal.https://patchthecve.com/cve/CVE-2018-19229.htmlhttps://patchthecve.com/cve/CVE-2018-19229.htmlWed, 17 Jun 2026 01:49:01 +0000MEDIUM 5.4: An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter.https://patchthecve.com/cve/CVE-2018-19228.htmlhttps://patchthecve.com/cve/CVE-2018-19228.htmlWed, 17 Jun 2026 01:49:01 +0000HIGH 7.5: An issue was discovered in LAOBANCMS 2.0. It allows arbitrary file deletion via ../ directory traversal in the admin/pic.php del parameter, as demonstrated by deleting install/install.txt to permit a reinstallation.https://patchthecve.com/cve/CVE-2018-19227.htmlhttps://patchthecve.com/cve/CVE-2018-19227.htmlWed, 17 Jun 2026 01:49:01 +0000MEDIUM 5.4: An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/liuyan.php neirong[] parameter.https://patchthecve.com/cve/CVE-2018-19226.htmlhttps://patchthecve.com/cve/CVE-2018-19226.htmlWed, 17 Jun 2026 01:49:00 +0000MEDIUM 5.3: An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to list .txt files via a direct request for the /data/0/admin.txt URI.https://patchthecve.com/cve/CVE-2018-19225.htmlhttps://patchthecve.com/cve/CVE-2018-19225.htmlWed, 17 Jun 2026 01:49:00 +0000HIGH 8.8: An issue was discovered in LAOBANCMS 2.0. admin/mima.php has CSRF.https://patchthecve.com/cve/CVE-2018-19224.htmlhttps://patchthecve.com/cve/CVE-2018-19224.htmlWed, 17 Jun 2026 01:49:00 +0000HIGH 7.5: An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies.https://patchthecve.com/cve/CVE-2018-19223.htmlhttps://patchthecve.com/cve/CVE-2018-19223.htmlWed, 17 Jun 2026 01:49:00 +0000MEDIUM 4.8: An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI.https://patchthecve.com/cve/CVE-2018-19222.htmlhttps://patchthecve.com/cve/CVE-2018-19222.htmlWed, 17 Jun 2026 01:49:00 +0000CRITICAL 9.8: An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysql_hy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists.https://patchthecve.com/cve/CVE-2018-19221.htmlhttps://patchthecve.com/cve/CVE-2018-19221.htmlWed, 17 Jun 2026 01:49:00 +0000CRITICAL 9.8: An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter.https://patchthecve.com/cve/CVE-2018-19220.htmlhttps://patchthecve.com/cve/CVE-2018-19220.htmlWed, 17 Jun 2026 01:49:00 +0000CRITICAL 9.8: An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI.