CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-44977
https://notcve.org/view.php?id=CVE-2021-44977
04 Feb 2022 — In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files. En iCMS versiones anteriores a 8.0.0 incluyéndola, una vulnerabilidad de salto de directorio permite a un atacante leer archivos arbitrarios • https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%960day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-44978
https://notcve.org/view.php?id=CVE-2021-44978
04 Feb 2022 — iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution. iCMS versiones anteriores a 8.0.0 incluyéndola, permite a usuarios añadir y renderizar una plantilla comtom, que presenta una vulnerabilidad SSTI que causa una ejecución de código remota • https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5%E5%AF%BC%E8%87%B4%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C0day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18070
https://notcve.org/view.php?id=CVE-2020-18070
29 Apr 2021 — Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()" method of the component "database.admincp.php". Un Salto de Ruta en iCMS versión v7.0.13, permite a atacantes remotos eliminar carpetas al inyectar comandos en una petición HTTP diseñada en el método "do_del()" del componente "database.admincp.php". • https://github.com/idreamsoft/iCMS/issues/46 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 1CVE-2019-8902
https://notcve.org/view.php?id=CVE-2019-8902
18 Feb 2019 — An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI. Se ha descubierto un problema en idreamsoft iCMS hasta la versión 7.0.14. Una vulnerabilidad de Cross-Site Request Forgery (CSRF) puede eliminar los artículos del usuario mediante el URI "public/api.php? • https://github.com/idreamsoft/iCMS/issues/56 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.1EPSS: 1%CPEs: 1EXPL: 1CVE-2019-7234
https://notcve.org/view.php?id=CVE-2019-7234
30 Jan 2019 — An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloaded via an admincp.php?app=apps&do=pack request. Se ha descubierto un problema en idreamsoft iCMS 7.0.13. admincp.php? • https://github.com/idreamsoft/iCMS/issues/51 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-7236
https://notcve.org/view.php?id=CVE-2019-7236
30 Jan 2019 — An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal. Se ha descubierto un problema en idreamsoft iCMS 7.0.13. editor/editor.admincp.php permite un salto de directorio mediante dir=../ en admincp.php?app=editordo=fileManager. • https://github.com/idreamsoft/iCMS/issues/53 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2019-7237
https://notcve.org/view.php?id=CVE-2019-7237
30 Jan 2019 — An issue was discovered in idreamsoft iCMS 7.0.13 on Windows. editor/editor.admincp.php allows admincp.php?app=files&do=browse ..\ Directory Traversal. Se ha descubierto un problema en idreamsoft iCMS, en su versión 7.0.13 en Windows. editor/editor.admincp.php permite un salto de directorio mediante dir=..\ en admincp.php?app=editordo=fileManager. • https://github.com/idreamsoft/iCMS/issues/54 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-7235
https://notcve.org/view.php?id=CVE-2019-7235
30 Jan 2019 — An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to designate an arbitrary directory because of an apps.admincp.php error. This directory can then be deleted via an admincp.php?app=apps&do=uninstall request. Se ha descubierto un problema en idreamsoft iCMS 7.0.13. • https://github.com/idreamsoft/iCMS/issues/52 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2019-7160
https://notcve.org/view.php?id=CVE-2019-7160
29 Jan 2019 — idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php. idreamsoft iCMS 7.0.13 permite un salto de directorio ../ en admincp.php?app=files mediante el parámetro udir en files.admincp.php, que resulta en la ejecución de código PHP arbitrario de un archivo ZIP mediante el parámetro zipfile en admincp.php?app=apps, en a... • https://github.com/idreamsoft/iCMS/issues/50 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-6259
https://notcve.org/view.php?id=CVE-2019-6259
14 Jan 2019 — An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php _data_id parameter. Se ha descubierto un problema en idreamsoft iCMS V7.0.13. Hay Inyección SQL mediante el parámetro app/article/article.admincp.php _data_id. • https://github.com/idreamsoft/iCMS/issues/47 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •