EmpireCMS vulnerabilities

A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0 affecting an unknown function of the file /e/member/mspace/index.php. Manipulation of the spacename argument results in cross site scripting. The attack can be launched remotely, and the exploit has been released publicly and may be used in attacks.

A vulnerability was found in EmpireSoft EmpireCMS up to 8.0 in the CheckSaveTranFiletype function of the file e/class/connect.php, allowing unrestricted upload. The attack can be launched remotely, and the exploit has been disclosed publicly.

A flaw was found in EmpireSoft EmpireCMS up to 8.0 in the egetip function of the file e/class/connect.php in the IP Address Handler component. Manipulation causes protection mechanism failure. The attack can be initiated remotely, and the exploit has been published.