Known vulnerabilities in joyplus cms

Known vulnerabilities in joyplus cms

Vendor: joyplus

Software: joyplus cms

Software CPE: cpe:2.3:a:joyplus:joyplus-cms:*:*:*:*:*:*:*:*

Website: https://github.com/joyplus

Total vulnerabilities: 15

Public exploits: 0

Known exploited (KEV): 0

Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Vulnerabilities (15)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU35192 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2019-17175	CWE-22	Medium	No	No	-	04.10.2019	SB2018031530
#VU21288 - Improper Access Control CVE-2019-16655	CWE-284	Medium	No	No	-	23.09.2019	SB2019092110
#VU36836 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2018-14500	CWE-79	Low	No	No	-	22.07.2018	SB2018031530
#VU36837 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2018-14501	CWE-89	High	No	No	-	22.07.2018	SB2018031530
#VU36844 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2018-14388	CWE-79	Low	No	No	-	18.07.2018	SB2018031530
#VU36845 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2018-14389	CWE-89	High	No	No	-	18.07.2018	SB2018031530
#VU36898 - Unrestricted Upload of File with Dangerous Type CVE-2018-14334	CWE-434	High	No	No	-	17.07.2018	SB2018031530
#VU37001 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2018-12905	CWE-79	Low	No	No	-	27.06.2018	SB2018031530
#VU37068 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2018-12039	CWE-89	High	No	No	-	07.06.2018	SB2018031530
#VU37190 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2018-10096	CWE-79	Low	No	No	-	13.04.2018	SB2018031530
#VU37193 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2018-10073	CWE-79	Low	No	No	-	12.04.2018	SB2018031530
#VU37194 - Exposure of sensitive information to an unauthorized actor CVE-2018-10028	CWE-200	Medium	No	No	-	11.04.2018	SB2018031530
#VU37390 - Unrestricted Upload of File with Dangerous Type CVE-2018-8766	CWE-434	High	No	No	-	18.03.2018	SB2018031530
#VU37391 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2018-8767	CWE-79	Low	No	No	-	18.03.2018	SB2018031530
#VU37430 - Cross-Site Request Forgery (CSRF) CVE-2018-8717	CWE-352	High	No	No	-	15.03.2018	SB2018031530