Xiaocms 20141229
Approved changes feed: RSS · Atom
cpe:2.3:a:xiaocms:xiaocms:20141229:*:*:*:*:*:*:*part: a version: 20141229 update: *
| Vendor | Xiaocms (fab69832-1450-51b6-b6cf-951e85b74c57) |
|---|---|
| Product | Xiaocms (de81a438-45be-5c59-8cff-107d6cb74069) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/rebill/xiaocms-x1 |
purl2cpe | 2026-06-01 10:12:57.937863 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-6127 |
vulnerable | 2026-06-08 05:14:08.793072 |
Details available
An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table[] SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename.
Published: 2019-01-11T05:00:00.000Z
Updated: 2024-09-17T01:46:23.630Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19197 |
vulnerable | 2026-06-08 05:11:15.453280 |
Details available
An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths[]=../ directory traversal.
Published: 2018-11-12T05:00:00.000Z
Updated: 2024-09-17T03:17:23.561Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19196 |
vulnerable | 2026-06-08 05:11:15.452905 |
Details available
An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types (jpg, jpeg, bmp, png, gif), as demonstrated by an admin/index.php?c=uploadfile&a=uploadify_upload&type=php URI.
Published: 2018-11-12T05:00:00.000Z
Updated: 2024-09-16T20:07:31.615Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19195 |
vulnerable | 2026-06-08 05:11:15.452609 |
Details available
An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\show_product.html file.
Published: 2018-11-12T05:00:00.000Z
Updated: 2024-09-16T19:04:19.489Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19194 |
vulnerable | 2026-06-08 05:11:15.452336 |
Details available
An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message.
Published: 2018-11-12T05:00:00.000Z
Updated: 2024-09-17T03:43:31.978Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19193 |
vulnerable | 2026-06-08 05:11:15.451867 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19192 |
vulnerable | 2026-06-08 05:11:15.451483 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.