keheying/onekeyadmin

GitHub

github.com

Releases0

Stars55

基于Thinkphp6+Element的插件化管理系统，网站、小程序、商城、CMS、APP、ERP、API接口一个系统全部搞定，无需脚手架开箱即用！

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2023-26951 ↗	Mar 16, 2023Thursday, 16 March 2023, 01:15	5.4 MEDIUM	—
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module.
CVE-2023-26957 ↗	Mar 9, 2023Thursday, 9 March 2023, 21:15	9.1 CRITICAL	—
onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins.
CVE-2023-26948 ↗	Mar 9, 2023Thursday, 9 March 2023, 01:15	7.5 HIGH	—
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download.
CVE-2023-26956 ↗	Mar 8, 2023Wednesday, 8 March 2023, 19:15	7.5 HIGH	—
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.
CVE-2023-26952 ↗	Mar 8, 2023Wednesday, 8 March 2023, 14:15	5.4 MEDIUM	—
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.
CVE-2023-26950 ↗	Mar 8, 2023Wednesday, 8 March 2023, 13:15	5.4 MEDIUM	—
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Categories module.
CVE-2023-26953 ↗	Mar 7, 2023Tuesday, 7 March 2023, 15:15	4.8 MEDIUM	—
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module.
CVE-2023-26954 ↗	Mar 7, 2023Tuesday, 7 March 2023, 13:15	5.4 MEDIUM	—
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.
CVE-2023-26955 ↗	Mar 7, 2023Tuesday, 7 March 2023, 13:15	5.4 MEDIUM	—
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin Group module.
CVE-2023-26949 ↗	Mar 6, 2023Monday, 6 March 2023, 21:15	9.8 CRITICAL	—
An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHP file.