Joyplus Cms CVE-2018-10028

MEDIUM

Information Exposure (CWE-200)

2018-04-11 cve@mitre.org

Information Disclosure Joyplus Cms

5.3

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Apr 11, 2018 - 18:29 nvd

MEDIUM 5.3

DescriptionNVD

joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI.

AnalysisAI

joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI. Affected products include: Joyplus-Cms Project Joyplus-Cms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.

More in Joyplus Cms

View all

CVE-2018-14501 CRITICAL Act Now POC

manager/admin_ajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "m

CVE-2018-14389 CRITICAL Act Now POC

joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter. Rated critical severity (CVSS 9.8), th

CVE-2018-14334 CRITICAL Act Now POC

manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file exten

CVE-2018-12039 CRITICAL Act Now POC

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php

CVE-2018-8766 CRITICAL Act Now POC

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, r

CVE-2018-8717 HIGH This Week POC

joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&

CVE-2019-17175 HIGH This Week POC

joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal. Rated high severity (CVSS 7.5), this v

CVE-2018-14500 MEDIUM This Month POC

joyplus-cms 1.6.0 has XSS via the manager/collect/collect_vod_zhuiju.php keyword parameter. Rated medium severity (CVSS

CVE-2018-12905 MEDIUM This Month POC

joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions. Rated med

CVE-2018-14388 MEDIUM This Month POC

joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter. Rated medium severity (CVSS

CVE-2018-10096 MEDIUM This Month POC

joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request. Rated

CVE-2018-10073 MEDIUM This Month POC

joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter. Rated medium severity (CVSS 4.8), this vul

Same weakness CWE-200 – Information Exposure

View all

CVE-2016-6415 HIGH POC

CVE-2013-7331 MEDIUM POC

CVE-2025-31125 MEDIUM POC

CVE-2025-11749 CRITICAL POC

CVE-2017-16894 HIGH POC

CVE-2017-11165 CRITICAL POC

CVE-2016-2388 MEDIUM POC

CVE-2016-1561 HIGH POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2018-10028 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy