Search
Total
5 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-18215 | 1 Phpshe | 1 Phpshe | 2021-02-12 | 6.5 MEDIUM | 8.8 HIGH |
| Multiple SQL Injection vulnerabilities in PHPSHE 1.7 in phpshe/admin.php via the (1) ad_id, (2) menu_id, and (3) cashout_id parameters, which could let a remote malicious user execute arbitrary code. | |||||
| CVE-2019-6707 | 1 Phpshe | 1 Phpshe | 2020-08-24 | 6.5 MEDIUM | 7.2 HIGH |
| PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product_id[] parameter. | |||||
| CVE-2019-6708 | 1 Phpshe | 1 Phpshe | 2020-08-24 | 6.5 MEDIUM | 7.2 HIGH |
| PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter. | |||||
| CVE-2019-9761 | 1 Phpshe | 1 Phpshe | 2019-03-14 | 5.0 MEDIUM | 7.5 HIGH |
| An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs because of the call to wechat_getxml in include/plugin/payment/wechat/notify_url.php. | |||||
| CVE-2018-18485 | 1 Phpshe | 1 Phpshe | 2019-01-08 | 6.4 MEDIUM | 7.5 HIGH |
| An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This can be leveraged to reload the product by deleting install.lock. | |||||