Onekeyadmin - vulnerabilities (CVEs)

8 CVEs in 1 products, 0 in the last 30 days, newest from 2023-03-16.

Products

CVE-2023-26951 - CVSS 5.4 (medium), 2023-03-16: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module.
CVE-2023-26957 - CVSS 9.1 (critical), 2023-03-09: onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins.
CVE-2023-26948 - CVSS 7.5 (high), 2023-03-09: onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download.
CVE-2023-26956 - CVSS 7.5 (high), 2023-03-08: onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.
CVE-2023-26952 - CVSS 5.4 (medium), 2023-03-08: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.
CVE-2023-26950 - CVSS 5.4 (medium), 2023-03-08: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Categories module.
CVE-2023-26953 - CVSS 4.8 (medium), 2023-03-07: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module.
CVE-2023-26949 - CVSS 9.8 (critical), 2023-03-06: An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted…