Douco
Douco Douphp: vulnerabilidades y CVE
Douco Douphp tiene 20 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE20
Últimos 12 meses1
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-2226 | Baja (2) | 0.39% | — | 9 feb 2026 | A vulnerability has been found in DouPHP up to 1.9. This issue affects some unknown processing of the file /admin/file.php of the component ZIP File Handler. Such manipulation of the argument sql_filename leads to… |
| CVE-2024-57599 | Media (4.8) | 0.33% | — | 6 feb 2025 | Cross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to execute arbitrary code via a crafted payload injected into the description parameter in /admin/article.php |
| CVE-2024-7917 | Media (5.1) | 0.59% | — | 18 ago 2024 | A vulnerability, which was classified as critical, has been found in DouPHP 1.7 Release 20220822. Affected by this issue is some unknown functionality of the file /admin/system.php of the component Favicon Handler. The… |
| CVE-2022-46438 | Media (5.4) | 0.40% | — | 13 ene 2023 | A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component of DouPHP v1.7 20221118 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
| CVE-2022-24131 | Media (6.1) | 0.91% | — | 30 mar 2022 | DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaScript code execution. |
| CVE-2022-25574 | Media (4.8) | 0.43% | — | 25 mar 2022 | A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file. |
| CVE-2021-3370 | Media (6.1) | 0.56% | — | 8 dic 2021 | DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php. |
| CVE-2019-12564 | Crítica (9.8) | 2.0% | — | 3 jun 2019 | In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sql filenames. |
| CVE-2018-20567 | Media (5.3) | 1.0% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read. |
| CVE-2018-20566 | Media (5.3) | 1.3% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted installation page. |
| CVE-2018-20565 | Media (4.8) | 0.53% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the nav_name parameter. |
| CVE-2018-20564 | Media (4.8) | 0.53% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product_category.php?rec=update has XSS via the cat_name parameter. |
| CVE-2018-20563 | Media (4.8) | 0.53% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/mobile.php?rec=system&act=update has XSS via the mobile_name parameter. |
| CVE-2018-20562 | Media (4.8) | 0.53% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article_category.php?rec=update has XSS via the cat_name parameter. |
| CVE-2018-20561 | Media (4.8) | 0.53% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article.php?rec=update has XSS via the title parameter. |
| CVE-2018-20560 | Media (4.8) | 0.53% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/show.php?rec=update has XSS via the show_name parameter. |
| CVE-2018-20559 | Media (4.8) | 0.53% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter. |
| CVE-2018-20558 | Media (4.8) | 0.53% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the site_name parameter. |
| CVE-2018-20557 | Media (4.8) | 0.53% | — | 28 dic 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the page_name parameter. |
| CVE-2018-20419 | Alta (8.8) | 0.48% | — | 24 dic 2018 | DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account. |