arcms project vulnerabilities

Products

• arcms 2

Latest arcms project CVEs

Newest publication first

1. CVE-2018-19558 An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php.

   Published 2018-11-26

   Critical·CVSS 9.8 EPSS 1.1%

   An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php.

2. CVE-2018-19557 An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images.

   Published 2018-11-26

   Critical·CVSS 9.8 EPSS 1.5%

   An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.