This page lists publicly disclosed CVE vulnerabilities affecting lfdycms lei_feng_tv_cms (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2018-20604 | Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..* in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/*web*..*..*..*..*1.txt.html URI to read the 1.txt file. | [email protected] | 4.9 | 1.37% | 2018-12-30 | 2026-06-16 |
| CVE-2018-20603 | Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF. | [email protected] | 8.8 | 0.52% | 2018-12-30 | 2026-06-16 |
| CVE-2018-20602 | Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI. | [email protected] | 7.5 | 1.29% | 2018-12-30 | 2026-06-16 |