Read the docs

Ulicms

Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Ulicms records in CISA KEV

No Ulicms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ulicms 7 records HIGH

Records

7 records

TI-2023-30197 CVE-2023-53914 · GHSA-7ff4-756p-256w

UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability

Priority HIGH 81

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00686 Published 2025-12-17 No fix listed CWE-639
TI-2023-30207 CVE-2023-53924 · GHSA-xrjv-cxq7-2pw3

UliCMS 2023.1-sniffing-vicuna Remote Code Execution via Avatar Upload

Priority HIGH 73

UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar upload.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00944 Published 2025-12-17 No fix listed CWE-434
TI-2023-30208 CVE-2023-53925 · GHSA-w6g7-5cg4-mww6

UliCMS 2023.1 Stored Cross-Site Scripting via SVG File Upload

Priority MEDIUM 56

UliCMS 2023.1 contains a stored cross-site scripting vulnerability that allows attackers to upload malicious SVG files with embedded JavaScript.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00371 Published 2025-12-17 No fix listed CWE-79
Open these records in search →