DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account.
8.8CVSS
8.6AI Score
0.001EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the page_name parameter.
4.8CVSS
4.8AI Score
0.001EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the site_name parameter.
4.8CVSS
4.8AI Score
0.001EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter.
4.8CVSS
4.8AI Score
0.001EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/show.php?rec=update has XSS via the show_name parameter.
4.8CVSS
4.8AI Score
0.001EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article.php?rec=update has XSS via the title parameter.
4.8CVSS
4.8AI Score
0.001EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article_category.php?rec=update has XSS via the cat_name parameter.
4.8CVSS
4.8AI Score
0.001EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/mobile.php?rec=system&act=update has XSS via the mobile_name parameter.
4.8CVSS
4.8AI Score
0.001EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product_category.php?rec=update has XSS via the cat_name parameter.
4.8CVSS
4.8AI Score
0.001EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the nav_name parameter.
4.8CVSS
4.8AI Score
0.001EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted installation page.
5.3CVSS
5AI Score
0.002EPSS
An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read.
5.3CVSS
5.3AI Score
0.001EPSS
In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sql filenames.
9.8CVSS
9.3AI Score
0.033EPSS
DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php.
6.1CVSS
6AI Score
0.001EPSS
DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaScript code execution.
6.1CVSS
6.2AI Score
0.001EPSS
A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file.
4.8CVSS
4.9AI Score
0.001EPSS
A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component of DouPHP v1.7 20221118 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the description parameter.
5.4CVSS
5.3AI Score
0.001EPSS
A vulnerability, which was classified as critical, has been found in DouPHP 1.7 Release 20220822. Affected by this issue is some unknown functionality of the file /admin/system.php of the component Favicon Handler. The manipulation of the argument site_favicon leads to unrestricted upload. The atta...
7.2CVSS
4.9AI Score
0.002EPSS