CVE-2019-5310

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

YUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to the sys.php file, as demonstrated by site_title in an admin/system/basic POST request.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/doublefast/yunucms/issues/6Exploit, Third Party Advisory
https://github.com/doublefast/yunucms/issues/6Exploit, Third Party Advisory

Timeline

Published: Jan 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-53116.1An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw para CVE-2019-53129.8An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file.CVE-2019-53146.1Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS. An attacker would CVE-2019-53157.2A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitr CVE-2019-53176.8A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.CVE-2019-53186.5A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba Operating System Software version(s): 6.x.x.x: all versions CVE-2019-53199.8A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: CVE-2019-53206.1Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* befor CVE-2019-53218.8Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* befor CVE-2019-53227.5A remotely exploitable information disclosure vulnerability is present in Aruba Intelligent Edge Switch models 5400, 3810, 2920, 2930, 2530 CVE-2019-53237.2There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an administrative user ar CVE-2019-53267.2An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain code execution on th