Vendors / Ujcms Records 20 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 2
Exploited now Ujcms records in CISA KEV No Ujcms vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-For function in the header.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01294 · Published 2024-01-11 · No fix listed CWE-290
Priority HIGH 82
Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0121 · Published 2023-06-14 · No fix listed CWE-22
Priority HIGH 75
File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.20046 · Published 2023-06-14 · No fix listed CWE-434
Priority MEDIUM 60
A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter under the Add New Articles function.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00429 · Published 2023-02-17 · No fix listed CWE-79
Priority MEDIUM 58
A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00267 · Published 2024-12-16 · No fix listed CWE-601
Priority MEDIUM 57
A vulnerability was found in Dromara UJCMS 10.0.2.
CVSS 4.0 MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00384 · Published 2026-02-22 · No fix listed CWE-707
Priority MEDIUM 57
A vulnerability has been found in Dromara UJCMS 101.2.
CVSS 4.0 MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00883 · Published 2026-02-22 · No fix listed CWE-22
Priority MEDIUM 55
A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5.
CVSS 4.0 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00346 · Published 2025-03-18 · No fix listed CWE-79
Priority MEDIUM 55
A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3.
CVSS 3.1 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00324 · Published 2024-12-16 · No fix listed CWE-79
Priority MEDIUM 40
An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00703 · Published 2023-06-14 · No fix listed CWE-203
Priority LOW 37
File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0055 · Published 2024-01-12 · No fix listed CWE-434
Priority LOW 34
A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3.
CVSS 4.0 MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.03556 · Published 2024-12-11 · No fix listed CWE-285
Priority LOW 30
A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0082 · Published 2023-06-14 · No fix listed CWE-200
Priority LOW 22
A vulnerability was found in Dromara ujcms 9.7.5.
CVSS 4.0 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00328 · Published 2025-03-18 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
4 2 14 0 0
THREATIST.IORead the docs