Ofcms Project

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

Ofcms Project records in CISA KEV

No Ofcms Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Ofcms 20 records HIGH

Records

20 records in Ofcms · all components

TI-2024-22661 CVE-2024-34256 · GHSA-2g58-2x39-qh45

OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.

HIGH 82

OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00654 Published 2024-05-14 No fix listed CWE-89

TI-2024-32323 CVE-2024-48236 · GHSA-x467-hf2h-75gq

An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the…

MEDIUM 64

An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of the ofcms-admin\src\main\java\com\ofsoft\cms\core\uitle\FileUtils.java file

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00735 Published 2024-10-25 No fix listed CWE-94

TI-2024-32322 CVE-2024-48235 · GHSA-v7p7-p2fq-44fh

An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save…

MEDIUM 64

An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00735 Published 2024-10-25 No fix listed CWE-94

TI-2025-01341 CVE-2025-1557 · GHSA-3hx8-jcjc-x9xm

OFCMS cross-site request forgery

MEDIUM 57

A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00293 Published 2025-02-22 No fix listed CWE-352

TI-2024-08732 CVE-2024-9411 · GHSA-pggh-h238-4qvj

OFCMS add.json add cross site scripting

MEDIUM 57

A vulnerability classified as problematic has been found in OFCMS 1.1.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00367 Published 2024-10-01 No fix listed CWE-79

TI-2019-07034 CVE-2019-9617 · GHSA-43r8-qvvq-25fr

An issue was discovered in OFCMS before 1.1.3.

MEDIUM 43

An issue was discovered in OFCMS before 1.1.3.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02749 Published 2019-03-06 No fix listed CWE-434

TI-2019-07031 CVE-2019-9614 · GHSA-6rh3-q56c-rhc7

An issue was discovered in OFCMS before 1.1.3.

MEDIUM 43

An issue was discovered in OFCMS before 1.1.3.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0257 Published 2019-03-06 No fix listed CWE-74

TI-2019-07029 CVE-2019-9612 · GHSA-vxrx-78c8-h3c9

An issue was discovered in OFCMS before 1.1.3.

MEDIUM 43

An issue was discovered in OFCMS before 1.1.3.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02695 Published 2019-03-06 No fix listed CWE-434

TI-2019-07026 CVE-2019-9609 · GHSA-83px-qcvf-3rv7

An issue was discovered in OFCMS before 1.1.3.

MEDIUM 43

An issue was discovered in OFCMS before 1.1.3.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02695 Published 2019-03-06 No fix listed CWE-434

TI-2019-07025 CVE-2019-9608 · GHSA-9hq6-4mv4-qj9g

An issue was discovered in OFCMS before 1.1.3.

MEDIUM 43

An issue was discovered in OFCMS before 1.1.3.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02695 Published 2019-03-06 No fix listed CWE-434

TI-2023-10284 CVE-2023-24760 · GHSA-vx8v-3pw3-vg52

An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via…

MEDIUM 42

An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00842 Published 2023-03-16 No fix listed CWE-269

TI-2019-07033 CVE-2019-9616 · GHSA-236c-jvm7-g9g6

An issue was discovered in OFCMS before 1.1.3.

LOW 37

An issue was discovered in OFCMS before 1.1.3.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02708 Published 2019-03-06 No fix listed CWE-706

TI-2019-07030 CVE-2019-9613 · GHSA-vrpc-m6wc-w222

An issue was discovered in OFCMS before 1.1.3.

LOW 37

An issue was discovered in OFCMS before 1.1.3.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02708 Published 2019-03-06 No fix listed CWE-434

TI-2019-07032 CVE-2019-9615 · GHSA-r6xg-v7vc-2h53

An issue was discovered in OFCMS before 1.1.3.

LOW 34

An issue was discovered in OFCMS before 1.1.3.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01298 Published 2019-03-06 No fix listed CWE-89

TI-2019-07028 CVE-2019-9611 · GHSA-5m56-c6gr-gc7v

An issue was discovered in OFCMS before 1.1.3.

LOW 32

An issue was discovered in OFCMS before 1.1.3.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01441 Published 2019-03-06 No fix listed CWE-22

TI-2022-12080 CVE-2022-29653 · GHSA-hm52-fmcr-vp69

OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the…

LOW 28

OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00578 Published 2022-05-31 No fix listed CWE-79

TI-2023-28431 CVE-2023-51807 · GHSA-cqrq-pcmc-2376

Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain…

LOW 25

Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0045 Published 2024-01-16 No fix listed CWE-79

TI-2022-10822 CVE-2022-27961 · GHSA-x244-746v-9wx6

A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows…

LOW 25

A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment text box.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00436 Published 2022-04-10 No fix listed CWE-79

TI-2022-10821 CVE-2022-27960 · GHSA-7j2x-68p3-rh6g

Insecure permissions configured in the user_id parameter at SysUserController.java of…

LOW 25

Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' personal information.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00466 Published 2022-04-10 No fix listed CWE-276

TI-2019-07027 CVE-2019-9610 · GHSA-ph42-3v2x-r6x8

An issue was discovered in OFCMS before 1.1.3.

LOW 23

An issue was discovered in OFCMS before 1.1.3.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01362 Published 2019-03-06 No fix listed CWE-22

Open these records in search →