Priority HIGH 82
An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00709 · Published 2025-03-06 · No fix listed CWE-434
Priority HIGH 82
PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01045 · Published 2023-06-15 · No fix listed CWE-732
Priority HIGH 82
SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSiteAdminControl.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01142 · Published 2023-04-04 · No fix listed CWE-89
Priority HIGH 82
SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01142 · Published 2023-04-04 · No fix listed CWE-89
Priority HIGH 80
PublicCMS V5.202506.b is vulnerable to SSRF.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00353 · Published 2025-12-01 · No fix listed CWE-918
Priority HIGH 77
OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.01147 · Published 2025-09-29 · No fix listed CWE-78
Priority HIGH 73
PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00188 · Published 2025-12-01 · No fix listed CWE-352
Priority HIGH 73
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00667 · Published 2024-07-12 · No fix listed CWE-434
Priority HIGH 73
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00667 · Published 2024-07-12 · No fix listed CWE-434
Priority HIGH 73
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00721 · Published 2024-07-12 · No fix listed CWE-94
Priority HIGH 73
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00458 · Published 2024-07-12 · No fix listed CWE-918
Priority HIGH 73
An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00875 · Published 2024-04-16 · No fix listed CWE-284
Priority HIGH 72
PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00477 · Published 2025-12-01 · No fix listed CWE-22
Priority HIGH 71
PublicCMS v5.202506.d and earlier is vulnerable to stored XSS.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00399 · Published 2026-02-27 · No fix listed CWE-79
Priority HIGH 71
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00423 · Published 2024-07-12 · No fix listed CWE-434
Priority HIGH 71
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00302 · Published 2024-07-12 · No fix listed CWE-918
Priority HIGH 70
A vulnerability was detected in Sanluan PublicCMS 5.202506.d.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00281 · Published 2026-05-17 · No fix listed CWE-320
Priority HIGH 70
A weakness has been identified in Sanluan PublicCMS 5.202506.d.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00403 · Published 2026-05-17 · No fix listed CWE-287
Priority HIGH 67
publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0051 · Published 2024-08-23 · No fix listed CWE-434
Priority MEDIUM 64
A vulnerability, which was classified as problematic, was found in Tianjin PubliCMS 4.0.202302.e.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00322 · Published 2024-03-26 · No fix listed CWE-352
Priority MEDIUM 63
A weakness has been identified in Sanluan PublicCMS 6.202506.d.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00755 · Published 2026-02-27 · No fix listed CWE-22
Priority MEDIUM 62
PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00328 · Published 2024-07-12 · No fix listed CWE-284
Priority MEDIUM 62
An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00654 · Published 2023-11-15 · No fix listed CWE-918
Priority MEDIUM 62
PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.21951 · Published 2022-02-14 · No fix listed CWE-78
Priority MEDIUM 58
PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0017 · Published 2025-12-22 · No fix listed CWE-79
Load more
THREATIST.IORead the docs