Vendors / Cxuu Records 8 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 2
Exploited now Cxuu records in CISA KEV No Cxuu vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority LOW 39
cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.03797 · Published 2020-11-18 · No fix listed CWE-89
Priority LOW 33
SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php.
CVSS 3.1 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00875 · Published 2021-08-27 · No fix listed CWE-89
Priority LOW 29
CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add.
CVSS 3.1 MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00439 · Published 2020-12-26 · No fix listed CWE-352
Priority LOW 28
Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00716 · Published 2022-03-29 · No fix listed CWE-79
Priority LOW 28
Multiple Cross Site Scripting (XSS) vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in (1) public/search.php and in the (2) c parameter in admin.php.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00641 · Published 2021-08-23 · No fix listed CWE-79
Priority LOW 28
CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00668 · Published 2020-12-27 · No fix listed CWE-79
Priority LOW 28
CXUUCMS V3 allows class="layui-input" XSS.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00668 · Published 2020-12-27 · No fix listed CWE-79
Priority LOW 23
CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add.
CVSS 3.1 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00663 · Published 2020-12-26 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
0 2 6 0 0
THREATIST.IORead the docs