Xiaocms is a narrowly scoped content management system, but its vulnerabilities have an elevated tendency toward critical severity despite modest volume. The recurring exposure centers on the core Xiaocms and Xiaocms X1 products and clusters around application-layer web vulnerabilities—including cross-site request forgery, cross-site scripting, sensitive information exposure, code injection, and path traversal—that are characteristic of input-handling and authorization weaknesses in web-facing platforms. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Xiaocms over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-19196CRITICAL An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php | Nov 12, 2018 | 9.8 | 30 | NO | NO |
CVE-2018-19192HIGH An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the data[content] parameter. | Nov 12, 2018 | 8.8 | 26 | NO | NO |
CVE-2018-14331HIGH An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my. | Jul 17, 2018 | 8.8 | 26 | NO | NO |
CVE-2019-6127HIGH An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table[] SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php file | Jan 11, 2019 | 7.2 | 24 | NO | NO |
CVE-2018-19193MEDIUM An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the "New news" screen. | Nov 12, 2018 | 6.1 | 21 | NO | NO |
CVE-2018-19195MEDIUM An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\show_product.html file. | Nov 12, 2018 | 6.1 | 20 | NO | NO |
CVE-2018-19197MEDIUM An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths[]=../ directory travers | Nov 12, 2018 | 4.9 | 19 | NO | NO |
CVE-2018-19194MEDIUM An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message. | Nov 12, 2018 | 5.3 | 19 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Xiaocms.
Media articles that mention a CVE ID that affects a product developed by Xiaocms — matched by CVE ID, not by vendor name.