A vulnerability classified as critical was found in QiboSoft QiboCMS X1 up to 1.0.6. Affected by this vulnerability is the function rmb_pay of the file /application/index/controller/Pay.php. The manipulation of the argument callback_class leads to deserialization. The attack can be launched...
9.8CVSS
9.4AI Score
0.001EPSS
Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd and starttijd parameters of...
6.1CVSS
6.4AI Score
0.001EPSS
Qibosoft QiboCMS v7 was discovered to contain a remote code execution (RCE) vulnerability via the Get_Title function at...
8.8CVSS
9AI Score
0.002EPSS
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql...
7.5CVSS
7.4AI Score
0.003EPSS
A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted...
4.3CVSS
4.5AI Score
0.001EPSS
An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete...
9.1CVSS
9.1AI Score
0.002EPSS
A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator...
8.8CVSS
8.7AI Score
0.001EPSS
Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component...
5.4CVSS
5.2AI Score
0.001EPSS
A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0. An attacker is able execute arbitrary PHP code via exploitation of client_upgrade_edition.php and...
7.2CVSS
7.3AI Score
0.001EPSS
Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js"...
6.1CVSS
6.5AI Score
0.001EPSS
qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...
9.8CVSS
9.6AI Score
0.026EPSS
qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user...
8.8CVSS
8.5AI Score
0.001EPSS
SQL injection vulnerability in member/list.php in qibosoft Qi Bo CMS 7 allows remote attackers to execute arbitrary SQL commands via the aidDB[]...
8.7AI Score
0.001EPSS