txjia vulnerabilities

Products

• imcat 16

Latest txjia CVEs

Newest publication first

1. CVE-2021-35370 An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function.

   Published 2023-02-24

   Critical·CVSS 9.8 EPSS 1.0%

   An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function.

2. CVE-2021-35369 Arbitrary File Read vulnerability found in Peacexie ImCat v.5.2 fixed in v.5.4 allows attackers to obtain sensitive information via the filtering_get_contents function.

   Published 2023-02-24

   Medium·CVSS 6.5 EPSS 0.65%

   Arbitrary File Read vulnerability found in Peacexie ImCat v.5.2 fixed in v.5.4 allows attackers to obtain sensitive information via the filtering_get_contents function.

3. CVE-2021-36444 Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page.

   Published 2023-02-03

   High·CVSS 8.8 EPSS 0.61%

   Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page.

4. CVE-2021-36443 Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.

   Published 2023-02-03

   High·CVSS 8.8 EPSS 0.61%

   Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.

5. CVE-2020-22120 A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execute arbitrary code.

   Published 2021-08-18

   High·CVSS 8.8 EPSS 2.5%

   A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execute arbitrary code.

6. CVE-2020-20392 SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php.

   Published 2021-06-23

   Critical·CVSS 9.8 EPSS 1.4%

   SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php.

7. CVE-2020-23520 imcat 5.2 allows an authenticated file upload and consequently remote code execution via the picture functionality.

   Published 2020-12-09

   High·CVSS 7.2 EPSS 2.3%

   imcat 5.2 allows an authenticated file upload and consequently remote code execution via the picture functionality.

8. CVE-2019-14968 An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action.

   Published 2019-08-12

   Critical·CVSS 9.8 EPSS 1.5%

   An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action.

9. CVE-2019-8436 imcat 4.5 has Stored XSS via the root/run/adm.php fm[instop][note] parameter.

   Published 2019-02-18

   Medium·CVSS 5.4 EPSS 0.61%

   imcat 4.5 has Stored XSS via the root/run/adm.php fm[instop][note] parameter.

10. CVE-2018-20611 imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.

    Published 2018-12-30

    Medium·CVSS 6.1 EPSS 0.94%

    imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.

11. CVE-2018-20610 imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter.

    Published 2018-12-30

    Medium·CVSS 4.9 EPSS 1.9%

    imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter.

12. CVE-2018-20609 imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI.

    Published 2018-12-30

    Medium·CVSS 5.3 EPSS 2.7%

    imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI.

13. CVE-2018-20608 imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.

    Published 2018-12-30

    High·CVSS 7.5 EPSS 12.1%

    imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.

14. CVE-2018-20607 imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI.

    Published 2018-12-30

    Medium·CVSS 5.3 EPSS 2.7%

    imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI.

15. CVE-2018-20606 imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI.

    Published 2018-12-30

    High·CVSS 7.5 EPSS 2.6%

    imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI.

16. CVE-2018-20605 imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file.

    Published 2018-12-30

    Critical·CVSS 9.8 EPSS 2.4%

    imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.