stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2018-14861 (severity: MEDIUM, weakness: CWE-732)
Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed passwords of other users.
CVE-2018-14862 (severity: MEDIUM, weakness: CWE-732)
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
CVE-2018-14863 (severity: HIGH, weakness: CWE-284)
Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC.
CVE-2018-14864 (severity: MEDIUM, weakness: CWE-284)
Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated users to inject arbitrary web script via a crafted attachment.
CVE-2018-14865 (severity: MEDIUM, weakness: CWE-200)
Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files.
CVE-2018-14866 (severity: MEDIUM, weakness: CWE-732)
Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.
CVE-2018-14867 (severity: MEDIUM, weakness: CWE-284)
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
CVE-2018-14868 (severity: MEDIUM, weakness: CWE-287)
Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.
CVE-2018-14869 (severity: MEDIUM, weakness: CWE-79)
PHP Template Store Script 3.0.6 allows XSS via the Address line 1, Address Line 2, Bank name, or A/C Holder name field in a profile.
CVE-2018-1487 (severity: HIGH, weakness: CWE-426)
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege users full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 140972.
CVE-2018-14872 (severity: HIGH, weakness: CWE-20)
An issue was discovered in Rincewind 0.1. A reinstall vulnerability exists because the parameter p of index.php and another file named commonPages.php allows an attacker to reinstall the product, with all data reset.
CVE-2018-14873 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in Rincewind 0.1. There is a cross-site scripting (XSS) vulnerability involving a p=account request to index.php and another file named commonPages.php.
CVE-2018-14874 (severity: HIGH, weakness: CWE-89)
An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1. Input passed through the code parameter in three pages as collaterals/colexe3t.jsp and /references/refsuppu.jsp and /references/refbranu.jsp is mishandled before being used in SQL queries, allowing SQL injection with an authenticated session.
CVE-2018-14875 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the Customerid, formName, FrameId, or MODE parameter.
CVE-2018-14876 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. Attackers can trigger a longjmp that leads to an uninitialized stack frame after a libpng error concerning the IHDR image width.
CVE-2018-14877 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in WeaselCMS v0.3.5. XSS exists via Site Language, Site Title, Site Description, and Site Keywords on the SETTINGS page.
CVE-2018-14878 (severity: HIGH, weakness: CWE-502)
JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL or EXE file) with a specific file, because of Deserialization of Untrusted Data.
CVE-2018-14879 (severity: HIGH, weakness: CWE-120)
The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().
CVE-2018-1488 (severity: HIGH, weakness: CWE-119)
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5 and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 140973.
CVE-2018-14880 (severity: HIGH, weakness: CWE-125)
The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().
CVE-2018-14881 (severity: HIGH, weakness: CWE-125)
The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).
CVE-2018-14882 (severity: HIGH, weakness: CWE-125)
The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.
CVE-2018-14883 (severity: HIGH, weakness: CWE-125)
An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.
CVE-2018-14884 (severity: HIGH, weakness: CWE-476)
An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because http_header_value in ext/standard/http_fopen_wrapper.c can be a NULL value that is mishandled in an atoi call.
CVE-2018-14885 (severity: CRITICAL, weakness: CWE-284)
Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds.
CVE-2018-14886 (severity: MEDIUM, weakness: CWE-732)
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
CVE-2018-14887 (severity: MEDIUM, weakness: CWE-20)
Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request.
CVE-2018-14888 (severity: MEDIUM, weakness: CWE-79)
inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject.
CVE-2018-14889 (severity: HIGH, weakness: CWE-20)
CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.
CVE-2018-14890 (severity: MEDIUM, weakness: CWE-79)
Vectra Networks Cognito Brain and Sensor before 4.2 contains a cross-site scripting (XSS) vulnerability in the Web Management Console.
CVE-2018-14891 (severity: HIGH, weakness: NVD-CWE-Other)
Management Console in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local privilege escalation vulnerability.
CVE-2018-14892 (severity: HIGH, weakness: CWE-352)
Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform state-changing actions via crafted HTTP forms.
CVE-2018-14893 (severity: HIGH, weakness: CWE-77)
A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API.
CVE-2018-14894 (severity: HIGH, weakness: CWE-269)
CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended access restrictions and execute blocked applications.
CVE-2018-14899 (severity: MEDIUM, weakness: CWE-79)
On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect users to malicious sites.
CVE-2018-14900 (severity: HIGH, weakness: CWE-417)
On EPSON WF-2750 printers with firmware JP02I2, there is no filtering of print jobs. Remote attackers can send print jobs directly to the printer via TCP port 9100.
CVE-2018-14901 (severity: HIGH, weakness: CWE-798)
The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services.
CVE-2018-14902 (severity: HIGH, weakness: CWE-200)
The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allows an attacker's application to read scanned documents.
CVE-2018-14903 (severity: HIGH, weakness: CWE-346)
EPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates, which allows remote attackers to cause a printer malfunction or send malicious data to the printer.
CVE-2018-14904 (severity: MEDIUM, weakness: CWE-79)
Samsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters, as demonstrated by ruiFw_pid.
CVE-2018-14905 (severity: MEDIUM, weakness: CWE-79)
The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter.
CVE-2018-14906 (severity: MEDIUM, weakness: CWE-79)
The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters.
CVE-2018-14907 (severity: MEDIUM, weakness: CWE-209)
The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discovering a full pathname.
CVE-2018-14908 (severity: HIGH, weakness: CWE-352)
Samsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printinformation/printReportSetupView.sws for a "Print emails sent" action.
CVE-2018-14910 (severity: HIGH, weakness: CWE-94)
SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php). The code is executed by visiting adm1n/admin_ip.php or data/admin/ip.php. This can also be exploited through CSRF.
CVE-2018-14911 (severity: HIGH, weakness: CWE-434)
A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by composing a request for a .txt upload and then changing it to a .php upload. The attacker must have admin access to change the upload_file_ext (aka "Allow upload file suffix") setting, and must use "php,php" in this setting to bypass the "php" restriction.
CVE-2018-14912 (severity: HIGH, weakness: CWE-22)
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
CVE-2018-14916 (severity: CRITICAL, weakness: CWE-732)
LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.
CVE-2018-14918 (severity: HIGH, weakness: CWE-22)
LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.
CVE-2018-14919 (severity: MEDIUM, weakness: CWE-79)
LOYTEC LGATE-902 6.3.2 devices allow XSS.
CVE-2018-1492 (severity: MEDIUM, weakness: CWE-384)
IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to properly log out from the previous session. IBM X-Force ID: 140977.
CVE-2018-14922 (severity: MEDIUM, weakness: CWE-79)
Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name field in the edit profile page.
CVE-2018-14923 (severity: HIGH, weakness: CWE-20)
A vulnerability in uniview EZPlayer 1.0.6 could allow an attacker to execute arbitrary code on a targeted system via video playback.
CVE-2018-14924 (severity: MEDIUM, weakness: CWE-79)
Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka user fullname) field.
CVE-2018-14925 (severity: CRITICAL, weakness: CWE-209)
Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components.
CVE-2018-14926 (severity: HIGH, weakness: CWE-352)
Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp request.
CVE-2018-14927 (severity: MEDIUM, weakness: CWE-22)
Matera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default application folder) via the /contingency/servlet/ServletFileDownload file parameter, related to /contingency/web/receiptQuery/receiptDisplay.jsp.
CVE-2018-14928 (severity: HIGH, weakness: CWE-200)
/contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the file parameter.
CVE-2018-14929 (severity: MEDIUM, weakness: CWE-79)
Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp (aka home page) url parameter.
CVE-2018-14930 (severity: HIGH, weakness: CWE-352)
An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1. CSRF can occur via a /CollatWebApp/gcmsRefInsert?name=SUPP URI.
CVE-2018-14931 (severity: MEDIUM, weakness: CWE-601)
An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. An open redirect exists via a /IntellectMain.jsp?IntellectSystem= URI.
CVE-2018-14933 (severity: CRITICAL, weakness: CWE-78)
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
CVE-2018-14934 (severity: MEDIUM, weakness: CWE-732)
The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker can connect without authentication and subsequently record audio from the device microphone.
CVE-2018-14935 (severity: MEDIUM, weakness: CWE-79)
The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS.
CVE-2018-14936 (severity: MEDIUM, weakness: CWE-79)
The Add page option in my little forum 2.4.12 allows XSS via the Title field.
CVE-2018-14937 (severity: MEDIUM, weakness: CWE-79)
The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field.
CVE-2018-14938 (severity: CRITICAL, weakness: CWE-125)
An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the function handle_prism during caplen processing. If the caplen is less than 144, one can cause an integer overflow in the function handle_80211, which will result in an out-of-bounds read and may allow access to sensitive memory (or a denial of service).
CVE-2018-14939 (severity: CRITICAL, weakness: CWE-119)
The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact if LibreOffice is automatically launched during web browsing with pathnames controlled by a remote web site.
CVE-2018-1494 (severity: MEDIUM, weakness: CWE-79)
IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141097.
CVE-2018-14940 (severity: HIGH, weakness: CWE-400)
PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkcode request.
CVE-2018-14941 (severity: MEDIUM, weakness: CWE-200)
Harmonic NSG 9000 devices allow remote authenticated users to read the webapp.py source code via a direct request for the /webapp.py URI.
CVE-2018-14942 (severity: HIGH, weakness: CWE-22)
Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATION_GET_FILE" or "POST /PY/EMULATION_EXPORT" with FileName=../../../passwd in the POST data.
CVE-2018-14943 (severity: CRITICAL, weakness: CWE-798)
Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account.
CVE-2018-14944 (severity: HIGH, weakness: CWE-787)
An issue has been found in jpeg_encoder through 2015-11-27. It is a SEGV in the function readFromBMP in jpeg_encoder.cpp. The signal is caused by an out-of-bounds write.
CVE-2018-14945 (severity: HIGH, weakness: CWE-787)
An issue has been found in jpeg_encoder through 2015-11-27. It is a heap-based buffer overflow in the function readFromBMP in jpeg_encoder.cpp.
CVE-2018-14946 (severity: HIGH, weakness: CWE-119)
An issue has been found in PDF2JSON 0.69. The HtmlString class in ImgOutputDev.cc has Mismatched Memory Management Routines (malloc versus operator delete).
CVE-2018-14947 (severity: HIGH, weakness: CWE-119)
An issue has been found in PDF2JSON 0.69. XmlFontAccu::CSStyle in XmlFonts.cc has Mismatched Memory Management Routines (operator new [] versus operator delete).
CVE-2018-14948 (severity: HIGH, weakness: CWE-119)
An issue has been found in dilawar sound through 2017-11-27. The end of openWavFile in wav-file.cc has Mismatched Memory Management Routines (operator new [] versus operator delete).
CVE-2018-1495 (severity: MEDIUM, weakness: CWE-269)
IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which could cause a denial of service. IBM X-Force ID: 141148.
CVE-2018-14950 (severity: MEDIUM, weakness: CWE-79)
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack.
CVE-2018-14951 (severity: MEDIUM, weakness: CWE-79)
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack.
CVE-2018-14952 (severity: MEDIUM, weakness: CWE-79)
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack.
CVE-2018-14953 (severity: MEDIUM, weakness: CWE-79)
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack.
CVE-2018-14954 (severity: MEDIUM, weakness: CWE-79)
The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.
CVE-2018-14955 (severity: MEDIUM, weakness: CWE-79)
The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).
CVE-2018-14956 (severity: CRITICAL, weakness: CWE-89)
CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws. An attacker can inject malicious queries into the application and obtain sensitive information.
CVE-2018-14957 (severity: CRITICAL, weakness: CWE-22)
CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.php?file=oggetto_documenti/../.././inc/config.php (one can take the control of the application because credentials are present in that config.php file).
CVE-2018-14958 (severity: HIGH, weakness: CWE-352)
An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and description) via index.php.
CVE-2018-14959 (severity: HIGH, weakness: CWE-352)
An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI.
CVE-2018-1496 (severity: MEDIUM, weakness: CWE-79)
IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141219.
CVE-2018-14960 (severity: HIGH, weakness: CWE-352)
Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.
CVE-2018-14961 (severity: CRITICAL, weakness: CWE-89)
dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.
CVE-2018-14962 (severity: MEDIUM, weakness: CWE-79)
zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.
CVE-2018-14963 (severity: HIGH, weakness: CWE-352)
zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI.
CVE-2018-14964 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page.
CVE-2018-14965 (severity: HIGH, weakness: CWE-352)
An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF.
CVE-2018-14966 (severity: HIGH, weakness: CWE-352)
An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF.
CVE-2018-14967 (severity: HIGH, weakness: CWE-89)
An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.user.php has SQL Injection via the numPerPage parameter.
CVE-2018-14968 (severity: CRITICAL, weakness: CWE-89)
An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.address.php has SQL Injection via the numPerPage parameter.
CVE-2018-14969 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS.
CVE-2018-14970 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS.
CVE-2018-14971 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS.
CVE-2018-14972 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS.
CVE-2018-14973 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS.
CVE-2018-14974 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/news.php has XSS.
CVE-2018-14975 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS.
CVE-2018-14976 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS.
CVE-2018-14977 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070.
CVE-2018-14978 (severity: HIGH, weakness: CWE-352)
An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI.