PatchTheCVEjoyplus project vulnerabilities
Recent CVEs affecting joyplus project products. 4 tracked.
joyplus project has 4 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 0. Most recent: 2019-09-21. Highest priority: CVE-2018-14501 (score 63/100).
- CVE-2019-16660 HIGH 8.8 DOWNGRADE joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.
- CVE-2019-16656 CRITICAL 9.8 DOWNGRADE joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in th
- CVE-2019-16655 HIGH 7.5 DOWNGRADE joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.
- CVE-2018-14501 CRITICAL 9.8 DOWNGRADE manager/admin_ajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning
FAQ
How do I fix joyplus project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is joyplus project being exploited right now?
None of the tracked joyplus project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which joyplus project CVE should I patch first?
CVE-2018-14501 currently ranks highest (63/100): manager/admin_ajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning .