Wtcms Project: >> Wtcms Security Vulnerabilities
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header.
CVSS Score
9.8
EPSS Score
0.008
Published
2019-02-18
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service (resource consumption) via crafted dimensions for the verification code image.
CVSS Score
7.5
EPSS Score
0.006
Published
2019-02-18
An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=site_post CSRF.
CVSS Score
8.8
EPSS Score
0.001
Published
2019-02-18
An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box (for the website statistics code).
CVSS Score
6.1
EPSS Score
0.002
Published
2019-02-18
WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI.
CVSS Score
8.8
EPSS Score
0.001
Published
2018-04-22
Page 2