Joyplus-Cms

Every one of the 15 is a mark on the map. Named now: 1 to 15, most at risk first.

1. joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions.CVE-2018-12905Joyplus-Cms Project · 42% likely

   CWE-79

2. joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a sele…CVE-2018-12039Joyplus-Cms Project · 4.6% likely

   CWE-89

3. joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=add.CVE-2018-8766Joyplus-Cms Project · 3.3% likely

   CWE-434

4. joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal.CVE-2019-17175Joyplus-Cms Project · 1.7% likely

   CWE-22

5. manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise al…CVE-2018-14334Joyplus-Cms Project · 1.7% likely

   CWE-434

6. joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI.CVE-2018-10028Joyplus-Cms Project · 1.5% likely

   CWE-200

7. joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter.CVE-2018-14389Joyplus-Cms Project · 1.5% likely

   CWE-89

8. A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information.CVE-2020-22124Joyplus-Cms Project · 1.0% likely

   CWE-552

9. joyplus-cms 1.6.0 has XSS via the manager/collect/collect_vod_zhuiju.php keyword parameter.CVE-2018-14500Joyplus-Cms Project · 0.8% likely

   CWE-79

10. joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter.CVE-2018-14388Joyplus-Cms Project · 0.8% likely

    CWE-79

11. SQL injection vulnerability found in Joyplus-cms v.1.6.0 allows a remote attacker to access sensitive information via the id parameter of the goodbad() function.CVE-2020-20636Joyplus-Cms Project · CVSS 7.5 · 0.7% likely

    CWE-89

12. joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request.CVE-2018-8717Joyplus-Cms Project · 0.6% likely

    CWE-352

13. joyplus-cms 1.6.0 has XSS in manager/admin_ajax.php?action=save&tab={pre}vod_type via the t_name parameter.CVE-2018-8767Joyplus-Cms Project · 0.6% likely

    CWE-79

14. joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request.CVE-2018-10096Joyplus-Cms Project · 0.6% likely

    CWE-79

15. joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter.CVE-2018-10073Joyplus-Cms Project · 0.6% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.