Read the docs

doramart

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

doramart records in CISA KEV

No doramart vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-83840 CVE-2026-120448 · GHSA-x998-w6fg-m92w

DoraCMS Mass Assignment via API Key Update Endpoint

Priority HIGH 72

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00361 Published 2026-11-02 No fix listed CWE-915
TI-2026-20911 CVE-2026-25870 · GHSA-22v2-wj2v-mmrw

DoraCMS <= 3.1 UEditor Remote Image Fetch SSRF

Priority HIGH 70

DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00331 Published 2026-02-10 No fix listed CWE-918
Open these records in search →