TI-2023-28442 CVE-2023-51840 · GHSA-555g-cg2q-wmc3
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.
Priority MEDIUM 50
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.
Html-js
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Html-js records in CISA KEVNo Html-js vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records in Doracms · all components
TI-2022-15861 CVE-2022-35147 · GHSA-j35r-fv44-887q
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.
Priority MEDIUM 45
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.
TI-2023-27014 CVE-2023-49443 · GHSA-9w2m-c6wc-48q6
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames…
Priority MEDIUM 44
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords.
TI-2024-18960 CVE-2024-28715 · GHSA-9v27-xwh4-23q8
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker…
Priority MEDIUM 40
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint.
TI-2020-13349 CVE-2020-18220 · GHSA-6pr6-2grv-9mc6
Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain…
Priority LOW 33
Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susce…
TI-2026-03283 CVE-2026-3794 · GHSA-wvj6-8496-wm9r
doramart DoraCMS Email API send improper authentication
Priority LOW 32
A vulnerability was identified in doramart DoraCMS 3.0.x.
TI-2018-11909 CVE-2018-16622 · GHSA-jmm7-j5h8-qc7p
Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS…
Priority LOW 26
Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/u…
TI-2026-03284 CVE-2026-3795 · GHSA-r9h9-fgfp-v4m4
doramart DoraCMS v1.js createFileBypath path traversal
Priority LOW 25
A security flaw has been discovered in doramart DoraCMS 3.0.x.
TI-2023-27015 CVE-2023-49444 · GHSA-4398-q7v4-m5w6
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute…
Priority LOW 25
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar.
TI-2022-09117 CVE-2022-25464 · GHSA-2g46-j24g-qvf7
A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of…
Priority LOW 22
A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.