Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Tuzicms records in CISA KEVNo Tuzicms vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority HIGH 82
Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00967 · Published 2023-01-25 · No fix listed CWE-89
Priority MEDIUM 45
App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01366 · Published 2019-09-20 · No fix listed CWE-89
Priority MEDIUM 44
TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0108 · Published 2022-03-28 · No fix listed CWE-89
Priority LOW 39
TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00547 · Published 2019-09-21 · No fix listed CWE-352
Priority LOW 39
TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00547 · Published 2019-09-21 · No fix listed CWE-352
Priority LOW 39
An issue was discovered in TuziCMS v2.0.6.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00505 · Published 2018-04-17 · No fix listed CWE-352
Priority LOW 29
TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00749 · Published 2019-09-21 · No fix listed CWE-79
THREATIST.IORead the docs