Dreamer

Records40All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high23CVSS 7.0–8.9

Exploited now

Dreamer records in CISA KEV

No Dreamer vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Dreamer Cms 39 records HIGH

Records

40 records

TI-2023-25324 CVE-2023-46886 · GHSA-5rqj-g24x-g4wv

Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal.

HIGH 80

Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00992 Published 2023-11-29 No fix listed CWE-22

TI-2023-26681 CVE-2023-48912 · GHSA-q9px-83q2-6hjr

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.

HIGH 73

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0036 Published 2023-11-30 No fix listed CWE-352

TI-2023-25325 CVE-2023-46887 · GHSA-v46f-6x32-qw44

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.

HIGH 72

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00292 Published 2023-11-29 No fix listed CWE-494

TI-2024-03103 CVE-2024-3311 · GHSA-96rw-9jfw-gw2m

Dreamer CMS ThemesController.java ZipUtils.unZipFiles path traversal

HIGH 71

A vulnerability was found in Dreamer CMS up to 4.1.3.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01016 Published 2024-04-04 No fix listed CWE-22

TI-2024-16954 CVE-2024-25811 · GHSA-mm2p-hcgv-77p3

An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information.

MEDIUM 62

An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00581 Published 2024-02-29 No fix listed CWE-284

TI-2024-02189 CVE-2024-2354 · GHSA-mqwf-p679-m69g

Dreamer CMS toEdit cross-site request forgery

MEDIUM 62

A vulnerability, which was classified as problematic, was found in Dreamer CMS 4.1.3.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00299 Published 2024-03-10 No fix listed CWE-352

TI-2023-23528 CVE-2023-43857 · GHSA-pp69-589j-qf57

Dreamer CMS v4.1.3 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Dreamer CMS v4.1.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /admin/u/toIndex.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0046 Published 2023-09-26 No fix listed CWE-79

TI-2025-03520 CVE-2025-3977 · GHSA-77gx-3fxf-6gxj

iteachyou Dreamer CMS Attachment download improper authorization

MEDIUM 57

A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00373 Published 2025-04-27 No fix listed CWE-266

TI-2025-01329 CVE-2025-1543 · GHSA-j22r-rxv9-h8pm

iteachyou Dreamer CMS ueditor-1.4.3.3 path traversal

MEDIUM 57

A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00764 Published 2025-02-21 No fix listed CWE-22

TI-2025-01334 CVE-2025-1548 · GHSA-chfj-fxfr-5gj5

iteachyou Dreamer CMS edit cross site scripting

MEDIUM 56

A vulnerability was found in iteachyou Dreamer CMS 4.1.3.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00349 Published 2025-02-21 No fix listed CWE-79

TI-2025-09469 CVE-2025-10320 · GHSA-vcpv-43p8-jh9j

iteachyou Dreamer CMS updatePwd weak password

MEDIUM 45

A vulnerability was detected in iteachyou Dreamer CMS up to 4.1.3.2.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00245 Published 2025-09-12 No fix listed CWE-521

TI-2023-23226 CVE-2023-43382 · GHSA-j6hf-hmj6-c2wc

Directory Traversal vulnerability in itechyou dreamer CMS v.4.1.3 allows a remote…

MEDIUM 44

Directory Traversal vulnerability in itechyou dreamer CMS v.4.1.3 allows a remote attacker to execute arbitrary code via the themePath in the uploaded template function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01819 Published 2023-09-25 No fix listed CWE-22

TI-2021-19144 CVE-2021-43084 · GHSA-rrcv-2666-p98f

An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter.

MEDIUM 44

An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00956 Published 2022-03-24 No fix listed CWE-89

TI-2023-22550 CVE-2023-42279 · GHSA-qv8j-2w84-7prx

Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.

MEDIUM 43

Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00788 Published 2023-09-21 No fix listed CWE-89

TI-2023-23527 CVE-2023-43856 · GHSA-m3f3-pc2w-56jq

Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the…

MEDIUM 41

Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00976 Published 2023-09-26 No fix listed CWE-552

TI-2023-02322 CVE-2023-2473 · GHSA-q4c2-wh8v-28q5

Dreamer CMS Password Hash Calculation UserController.java updatePwd algorithmic complexity

MEDIUM 41

A vulnerability was found in Dreamer CMS up to 4.1.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00929 Published 2023-05-02 No fix listed CWE-407

TI-2023-26021 CVE-2023-48060 · GHSA-r24p-5gqm-pc2r

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00364 Published 2023-11-13 No fix listed CWE-352

TI-2023-26020 CVE-2023-48058 · GHSA-5prh-qxfc-v7vp

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00364 Published 2023-11-13 No fix listed CWE-352

TI-2023-26001 CVE-2023-48021 · GHSA-7j7r-3hfp-h2h7

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00356 Published 2023-11-14 No fix listed CWE-352

TI-2023-26000 CVE-2023-48020 · GHSA-m6rf-6fjq-59j6

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF)…

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00356 Published 2023-11-14 No fix listed CWE-352

TI-2023-25999 CVE-2023-48017 · GHSA-2x7x-86wq-p8fq

Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions…

MEDIUM 40

Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00353 Published 2023-11-18 No fix listed CWE-352

TI-2023-24653 CVE-2023-45907 · GHSA-xc8p-j5f8-7w98

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00376 Published 2023-10-17 No fix listed CWE-352

TI-2023-24652 CVE-2023-45906 · GHSA-qgg9-7g95-6v4j

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add.

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00376 Published 2023-10-17 No fix listed CWE-352

TI-2023-24651 CVE-2023-45905 · GHSA-9jm9-9xjf-h3x2

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add.

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00376 Published 2023-10-17 No fix listed CWE-352

TI-2023-24650 CVE-2023-45904 · GHSA-433v-4977-67pv

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update.

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00376 Published 2023-10-17 No fix listed CWE-352

Open these records in search →

Critical	3
High	23
Medium	13
Low	1
No CVSS	0