Priority HIGH 82
Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01177 · Published 2024-11-18 · No fix listed CWE-94
Priority HIGH 74
A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00408 · Published 2024-10-11 · No fix listed CWE-918
Priority HIGH 73
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.Att…
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0098 · Published 2024-08-22 · No fix listed CWE-69
Priority MEDIUM 57
A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00377 · Published 2024-12-09 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00563 · Published 2024-11-28 · No fix listed CWE-79
Priority MEDIUM 56
A vulnerability has been found in jpress up to 5.1.1 and classified as critical.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00551 · Published 2024-08-29 · No fix listed CWE-22
Priority MEDIUM 46
jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02188 · Published 2022-01-13 · No fix listed
Priority MEDIUM 42
An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerability than CVE-2024-43033.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00736 · Published 2024-04-25 · No fix listed CWE-94
Priority MEDIUM 42
A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR package.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01926 · Published 2022-02-04 · No fix listed
Priority MEDIUM 41
jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01339 · Published 2022-01-26 · No fix listed CWE-94
Priority MEDIUM 41
jpress v4.2.0 allows users to register an account by default.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01305 · Published 2022-01-19 · No fix listed CWE-434
Priority MEDIUM 41
jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.014 · Published 2022-01-13 · No fix listed CWE-94
Priority LOW 37
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02753 · Published 2022-01-26 · No fix listed CWE-94
Priority LOW 36
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02324 · Published 2022-01-26 · No fix listed CWE-94
Priority LOW 36
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02151 · Published 2022-01-26 · No fix listed CWE-434
Priority LOW 34
jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01112 · Published 2022-01-26 · No fix listed CWE-434
Priority LOW 25
An issue was discovered in JPress v3.3.0 and below.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00545 · Published 2021-06-18 · No fix listed CWE-79
Priority LOW 25
XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00506 · Published 2019-01-14 · No fix listed CWE-79
Priority LOW 23
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name parameter.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.0064 · Published 2018-11-11 · No fix listed CWE-79
THREATIST.IORead the docs