Priority HIGH 72
Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00518 · Published 2026-03-27 · No fix listed CWE-918
Priority HIGH 65
A vulnerability, which was classified as critical, was found in OTCMS 7.01.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00584 · Published 2023-12-13 · No fix listed CWE-89
Priority MEDIUM 60
A vulnerability was found in OTCMS 6.72.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00617 · Published 2023-03-25 · No fix listed CWE-79
Priority MEDIUM 53
OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00302 · Published 2025-01-17 · No fix listed CWE-918
Priority MEDIUM 44
A vulnerability classified as critical was found in OTCMS up to 6.62.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00932 · Published 2023-06-14 · No fix listed CWE-259
Priority MEDIUM 44
A vulnerability classified as critical was found in OTCMS 6.0.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00873 · Published 2023-04-02 · No fix listed CWE-434
Priority MEDIUM 43
A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00738 · Published 2023-06-14 · No fix listed CWE-918
Priority MEDIUM 43
A vulnerability was found in OTCMS 6.72.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00744 · Published 2023-03-25 · No fix listed CWE-918
Priority LOW 37
OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.00879 · Published 2018-09-23 · No fix listed CWE-362
Priority LOW 36
OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does not block the "into/**/outfile" manipulation.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02071 · Published 2019-10-09 · No fix listed CWE-89
Priority LOW 35
A vulnerability was found in OTCMS up to 6.62 and classified as problematic.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00961 · Published 2023-06-14 · No fix listed CWE-22
Priority LOW 35
A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00961 · Published 2023-06-14 · No fix listed CWE-24
Priority LOW 31
A vulnerability has been found in OTCMS up to 6.62 and classified as problematic.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00964 · Published 2023-06-14 · No fix listed CWE-24
Priority LOW 29
OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00515 · Published 2019-10-09 · No fix listed CWE-352
Priority LOW 29
OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00848 · Published 2019-07-19 · No fix listed CWE-79
Priority LOW 28
An issue was discovered in OTCMS 3.61.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00692 · Published 2018-09-16 · No fix listed CWE-79
Priority LOW 28
An issue was discovered in OTCMS 3.61.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00692 · Published 2018-09-16 · No fix listed CWE-79
Priority LOW 28
OTCMS 3.20 allows XSS by adding a keyword or link to an article, as demonstrated by an admin/keyWord_deal.php?mudi=add request.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00683 · Published 2018-03-24 · No fix listed CWE-79
THREATIST.IORead the docs