GCVE - cpe:2.3:a:gxlcms:gxlcms_qy:1.0.0713:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gxlcms:gxlcms_qy:1.0.0713:*:*:*:*:*:*:*

part: a version: 1.0.0713 update: *

Vendor	Gxlcms (`4a130499-8da5-5887-98fe-b6c9aa735532`)
Product	Gxlcms Qy (`29829901-2734-51f6-93b8-bf03bae73eb0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-9852`	vulnerable	2026-06-08 05:12:08.327042	Details available In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query string within a Home-Hits request, as demonstrated hy sid=user,password%20from%20mysql.user%23. Published: 2018-04-08T02:00:00.000Z Updated: 2024-09-16T20:48:05.514Z Open on db.gcve.eu Reference links http://www.atksec.com/cve/GxlcmsQY-v1.0.0713-sqli/index.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-9851`	vulnerable	2026-06-08 05:12:08.326560	Details available In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as demonstrated by use of '\|' instead of '/' as a directory separator, in conjunction with a ".." sequence. Published: 2018-04-08T02:00:00.000Z Updated: 2024-09-17T02:31:58.983Z Open on db.gcve.eu Reference links http://www.atksec.com/cve/GxlcmsQY-v1.0.0713-DirectoryTraversal/index.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-9850`	vulnerable	2026-06-08 05:12:08.326252	Details available In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an Admin-Data-del request. Published: 2018-04-08T02:00:00.000Z Updated: 2024-09-17T01:10:40.040Z Open on db.gcve.eu Reference links http://www.atksec.com/cve/GxlcmsQY-v1.0.0713-filedelete/index.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-9848`	vulnerable	2026-06-08 05:12:08.324077	Details available In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using an Admin-Admin-Configsave request to change the config[upload_class] value from jpg,gif,png,jpeg to jpg,gif,png,jpeg,php and then making an Admin-Upload-Upload request. Published: 2018-04-07T21:00:00.000Z Updated: 2024-08-05T07:24:56.354Z Open on db.gcve.eu Reference links http://www.atksec.com/cve/GxlcmsQY-v1.0.0713-upload-getshell/index.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-9847`	vulnerable	2026-06-08 05:12:08.323771	Details available In Gxlcms QY v1.0.0713, the update function in Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to execute arbitrary PHP code by placing this code into a template. Published: 2018-04-07T21:00:00.000Z Updated: 2024-08-05T07:24:56.294Z Open on db.gcve.eu Reference links http://www.atksec.com/cve/GxlcmsQY-v1.0.0713-update-template-getshell/index.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-9247`	vulnerable	2026-06-08 05:12:07.966043	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.