Duxcms Project

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Duxcms Project records in CISA KEV

No Duxcms Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Duxcms 7 records HIGH

Records

7 records in Duxcms · all components

TI-2020-14194 CVE-2020-21861 · GHSA-cxvj-gmrx-gjv8

File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/upload.

HIGH 73

File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/upload.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0071 Published 2023-07-06 No fix listed CWE-434

TI-2020-14195 CVE-2020-21862 · GHSA-vhjr-xhj8-wrqr

Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBackup/del.

HIGH 70

Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBackup/del.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00962 Published 2023-07-06 No fix listed CWE-22

TI-2020-18808 CVE-2020-36610 · GHSA-w2pm-6h2c-v8hw

annyshow DuxCMS cross-site request forgery

HIGH 68

A vulnerability was found in annyshow DuxCMS 2.1.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00486 Published 2022-12-08 No fix listed CWE-863

TI-2020-14197 CVE-2020-21881 · GHSA-6gfh-pmhw-xg5r

Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote…

MEDIUM 62

Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify application data via article/admin/content/add.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0034 Published 2023-07-31 No fix listed CWE-352

TI-2020-18932 CVE-2020-36763 · GHSA-w2gw-6xj9-wg4r

Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00486 Published 2023-07-31 No fix listed CWE-79

TI-2020-18807 CVE-2020-36609 · GHSA-37qx-46xm-x54w

annyshow DuxCMS Article edit cross site scripting

MEDIUM 58

A vulnerability was found in annyshow DuxCMS 2.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00412 Published 2022-12-08 No fix listed CWE-707

TI-2021-02282 CVE-2021-3242 · GHSA-rq46-c763-3946

DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=.

MEDIUM 45

DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01227 Published 2022-02-16 No fix listed CWE-89

Open these records in search →

Critical	1
High	3
Medium	3
Low	0
No CVSS	0