jizhiCMS

Records39All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical12CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

jizhiCMS records in CISA KEV

No jizhiCMS vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Jizhicms 39 records HIGH

Records

39 records

TI-2025-32088 CVE-2025-50229 · GHSA-8r77-j8hp-jvhf

Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.

HIGH 82

Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00359 Published 2026-04-23 No fix listed CWE-89

TI-2025-19140 CVE-2025-25784 · GHSA-xg6j-fjj2-gv89

An arbitrary file upload vulnerability in the component \c\TemplateController.php of…

HIGH 82

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0092 Published 2025-02-26 No fix listed CWE-434

TI-2021-14778 CVE-2021-36484 · GHSA-jcg6-8qfh-25cm

SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL…

HIGH 82

SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0085 Published 2023-02-03 No fix listed CWE-89

TI-2023-27644 CVE-2023-50692 · GHSA-vpcq-h894-5962

File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary…

HIGH 77

File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00938 Published 2023-12-28 No fix listed CWE-434

TI-2023-27954 CVE-2023-51154 · GHSA-59j2-44h9-8h98

Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the…

HIGH 75

Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00612 Published 2024-01-04 No fix listed CWE-200

TI-2022-22286 CVE-2022-45278 · GHSA-27x8-wr44-c4fx

Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the…

HIGH 73

Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0077 Published 2022-11-23 No fix listed CWE-89

TI-2022-21690 CVE-2022-44140 · GHSA-p9w4-xg8j-5m8j

Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.

HIGH 73

Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0077 Published 2022-11-23 No fix listed CWE-89

TI-2020-19252 CVE-2020-37117 · GHSA-m4vr-wgxw-jjm6

jizhiCMS 1.6.7 - Arbitrary File Download

HIGH 72

jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00817 Published 2026-02-05 No fix listed CWE-434

TI-2025-43110 CVE-2025-70397 · GHSA-hxj5-g9j8-xgph

jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.

HIGH 67

jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00357 Published 2026-02-17 No fix listed CWE-89

TI-2023-20208 CVE-2023-38948 · GHSA-p39h-6928-4fq5

An arbitrary file download vulnerability in the /c/PluginsController.php component of…

HIGH 67

An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00951 Published 2023-08-03 No fix listed CWE-552

TI-2023-11990 CVE-2023-27235 · GHSA-8w2v-gr86-9vf3

An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of…

HIGH 67

An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00951 Published 2023-03-15 No fix listed CWE-434

TI-2023-23516 CVE-2023-43836 · GHSA-684c-fmh3-cpgp

There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information

MEDIUM 62

There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00729 Published 2023-10-02 No fix listed CWE-89

TI-2023-11989 CVE-2023-27234 · GHSA-gxfc-624w-5q2v

A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows…

MEDIUM 62

A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00282 Published 2023-03-15 No fix listed CWE-352

TI-2025-12803 CVE-2025-14012 · GHSA-m282-p3vv-884c

JIZHICMS Batch Delete Comments deleteAll.html delete sql injection

MEDIUM 58

A vulnerability was determined in JIZHICMS up to 2.5.5.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00415 Published 2025-12-04 No fix listed CWE-74

TI-2025-12802 CVE-2025-14011 · GHSA-55cq-ghm5-hggm

JIZHICMS Add Display Name Field addcomment.html commentlist sql injection

MEDIUM 58

A vulnerability was found in JIZHICMS up to 2.5.5.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00415 Published 2025-12-04 No fix listed CWE-74

TI-2023-15247 CVE-2023-31862 · GHSA-g4xp-6mr2-c9p8

jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS).

MEDIUM 58

jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00343 Published 2023-05-19 No fix listed CWE-79

TI-2026-02843 CVE-2026-3292 · GHSA-rwvh-hmmf-wpqx

jizhiCMS Batch Model.php findAll sql injection

MEDIUM 57

A security vulnerability has been detected in jizhiCMS up to 2.5.6.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.005 Published 2026-02-27 No fix listed CWE-74

TI-2025-12804 CVE-2025-14013 · GHSA-vhh7-7r7h-8w8g

JIZHICMS Comment addcomment.html cross site scripting

MEDIUM 57

A vulnerability was identified in JIZHICMS up to 2.5.5.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00304 Published 2025-12-04 No fix listed CWE-79

TI-2025-02305 CVE-2025-2639 · GHSA-847c-3v8q-4f53

JIZHICMS Article release.html improper authorization

MEDIUM 57

A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00413 Published 2025-03-23 No fix listed CWE-266

TI-2025-02304 CVE-2025-2638 · GHSA-qf7v-7r35-cmj2

JIZHICMS Article release.html improper authorization

MEDIUM 57

A vulnerability, which was classified as problematic, was found in JIZHICMS up to 1.7.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00413 Published 2025-03-23 No fix listed CWE-266

TI-2025-02303 CVE-2025-2637 · GHSA-vw9q-rqcg-vpfw

JIZHICMS Account Profile Page userinfo.html improper authorization

MEDIUM 57

A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00441 Published 2025-03-23 No fix listed CWE-266

TI-2025-19141 CVE-2025-25785 · GHSA-xmg6-qg4m-gw97

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the…

MEDIUM 48

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00441 Published 2025-02-26 No fix listed CWE-918

TI-2025-32087 CVE-2025-50228 · GHSA-3hh3-hx7r-ggc2

Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.

MEDIUM 47

Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00286 Published 2026-04-09 No fix listed CWE-918

TI-2024-21227 CVE-2024-32161 · GHSA-6ppw-252q-r2mf

jizhiCMS 2.5 suffers from a File upload vulnerability.

MEDIUM 44

jizhiCMS 2.5 suffers from a File upload vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00717 Published 2024-04-17 No fix listed CWE-434

TI-2023-02743 CVE-2023-2927 · GHSA-r3gq-r28g-g674

JIZHICMS TemplateController.php index server-side request forgery

MEDIUM 44

A vulnerability was found in JIZHICMS 2.4.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00867 Published 2023-05-27 No fix listed CWE-918

Open these records in search →