Douphp (Douco) - vulnerabilities (CVEs)

20 CVEs, 0 in the last 30 days, 12 known versions, newest CVE from 2026-02-09. Vendor: Douco.

CVEs of Douphp

• CVE-2026-2226 - CVSS 7.2 (high), 2026-02-09: A vulnerability has been found in DouPHP up to 1.9. This issue affects some unknown processing of the file /admin/file.php of the component ZIP File Handler.…
• CVE-2024-57599 - CVSS 4.8 (medium), 2025-02-06: Cross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to execute arbitrary code via a crafted payload injected into the…
• CVE-2024-7917 - CVSS 7.2 (high), 2024-08-18: A vulnerability, which was classified as critical, has been found in DouPHP 1.7 Release 20220822. Affected by this issue is some unknown functionality of the…
• CVE-2022-46438 - CVSS 5.4 (medium), 2023-01-13: A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component of DouPHP v1.7 20221118 allows attackers to execute arbitrary web…
• CVE-2022-24131 - CVSS 6.1 (medium), 2022-03-30: DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaScript code execution.
• CVE-2022-25574 - CVSS 4.8 (medium), 2022-03-25: A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a…
• CVE-2021-3370 - CVSS 6.1 (medium), 2021-12-08: DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php.
• CVE-2019-12564 - CVSS 9.8 (critical), 2019-06-03: In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for…
• CVE-2018-20566 - CVSS 5.3 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted…
• CVE-2018-20559 - CVSS 4.8 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter.
• CVE-2018-20562 - CVSS 4.8 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article_category.php?rec=update has XSS via the cat_name parameter.
• CVE-2018-20565 - CVSS 4.8 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the nav_name parameter.
• CVE-2018-20558 - CVSS 4.8 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the site_name parameter.
• CVE-2018-20561 - CVSS 4.8 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article.php?rec=update has XSS via the title parameter.
• CVE-2018-20564 - CVSS 4.8 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product_category.php?rec=update has XSS via the cat_name parameter.
• CVE-2018-20567 - CVSS 5.3 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock…
• CVE-2018-20557 - CVSS 4.8 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the page_name parameter.
• CVE-2018-20560 - CVSS 4.8 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. admin/show.php?rec=update has XSS via the show_name parameter.
• CVE-2018-20563 - CVSS 4.8 (medium), 2018-12-28: An issue was discovered in DouCo DouPHP 1.5 20181221. admin/mobile.php?rec=system&act=update has XSS via the mobile_name parameter.
• CVE-2018-20419 - CVSS 8.8 (high), 2018-12-24: DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account.