Txjia's vulnerability profile concentrates in a modestly represented web application product, IMCAT, where disclosures skew toward serious outcomes and reflect recurring application-layer weaknesses spanning sensitive information exposure, authentication bypass through CSRF, code injection, cross-site scripting, and SQL injection. The product appears to handle user input and data access across a web-facing surface, and vulnerabilities in these categories frequently attract public exploit code. Current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Txjia over time
Signals from CVEs in this vendor scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-20608HIGH imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI. | Dec 30, 2018 | 7.5 | 41 | NO | YES |
CVE-2019-14968CRITICAL An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action. | Aug 12, 2019 | 9.8 | 31 | NO | NO |
CVE-2018-20605CRITICAL imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file. | Dec 30, 2018 | 9.8 | 30 | NO | NO |
CVE-2021-35370CRITICAL An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function. | Feb 24, 2023 | 9.8 | 29 | NO | NO |
CVE-2021-36444HIGH Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page. | Feb 3, 2023 | 8.8 | 28 | NO | NO |
CVE-2021-36443HIGH Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification. | Feb 3, 2023 | 8.8 | 28 | NO | NO |
CVE-2020-22120HIGH A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execute arbitrary code. | Aug 18, 2021 | 8.8 | 28 | NO | NO |
CVE-2020-20392CRITICAL SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php. | Jun 23, 2021 | 9.8 | 28 | NO | NO |
CVE-2018-20606HIGH imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI. | Dec 30, 2018 | 7.5 | 25 | NO | NO |
CVE-2021-35369MEDIUM Arbitrary File Read vulnerability found in Peacexie ImCat v.5.2 fixed in v.5.4 allows attackers to obtain sensitive information via the filtering_get_contents function. | Feb 24, 2023 | 6.5 | 21 | NO | NO |
Signals from CVEs in this vendor scope (16 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Txjia.
Media articles that mention a CVE ID that affects a product developed by Txjia — matched by CVE ID, not by vendor name.