Wuzhicms

Records58All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical12CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

Wuzhicms records in CISA KEV

No Wuzhicms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wuzhicms 57 records HIGH Wuzhi Cms 1 record LOW

Records

58 records

TI-2023-28511 CVE-2023-52064 · GHSA-wcp2-36p3-v9xg

Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords…

HIGH 82

Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0064 Published 2024-01-10 No fix listed CWE-89

TI-2020-13844 CVE-2020-20413 · GHSA-x56c-grq3-w2x8

SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute…

HIGH 82

SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01343 Published 2023-06-20 No fix listed CWE-89

TI-2020-18426 CVE-2020-36037 · GHSA-658x-hxq7-f72p

An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte…

HIGH 73

An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01046 Published 2023-08-11 No fix listed

TI-2020-14029 CVE-2020-21325 · GHSA-cxpq-h2qw-mwp5

An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the…

HIGH 73

An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01263 Published 2023-06-20 No fix listed CWE-434

TI-2024-20435 CVE-2024-31008 · GHSA-wjf7-jjrj-rw8w

An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute…

MEDIUM 62

An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00673 Published 2024-04-03 No fix listed CWE-290

TI-2025-19180 CVE-2025-25916 · GHSA-pqmh-jm9r-hq9j

wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.

MEDIUM 58

wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00236 Published 2025-02-28 No fix listed CWE-79

TI-2023-15245 CVE-2023-31860 · GHSA-q3wv-mx62-wh2m

Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.

MEDIUM 58

Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00384 Published 2023-05-23 No fix listed CWE-79

TI-2023-14141 CVE-2023-30123 · GHSA-v9x8-qh99-p2rf

wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.

MEDIUM 58

wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00394 Published 2023-04-28 No fix listed CWE-79

TI-2024-09731 CVE-2024-10505 · GHSA-2ggq-hfx2-5mqh

wuzhicms block.php edit code injection

MEDIUM 57

A vulnerability was found in wuzhicms 4.1.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00713 Published 2024-10-30 No fix listed CWE-94

TI-2025-03132 CVE-2025-3563 · GHSA-7p3g-jgfx-frjh

WuzhiCMS Setting index.php set code injection

MEDIUM 56

A vulnerability was found in WuzhiCMS 4.1.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00712 Published 2025-04-14 No fix listed CWE-74

TI-2024-21232 CVE-2024-32206 · GHSA-26cp-j6f9-2w7c

A stored cross-site scripting (XSS) vulnerability in the component…

MEDIUM 54

A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $formdata p…

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00392 Published 2024-04-19 No fix listed CWE-79

TI-2023-25027 CVE-2023-46482 · GHSA-hw7v-x4gj-9m6p

SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute…

MEDIUM 52

SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/database/admin/index.php component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01415 Published 2023-11-01 No fix listed CWE-89

TI-2021-17641 CVE-2021-40670 · GHSA-g5h8-hjh2-8m54

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under…

MEDIUM 45

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0128 Published 2021-09-16 No fix listed CWE-89

TI-2021-17640 CVE-2021-40669 · GHSA-qg5j-588p-fv46

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under…

MEDIUM 45

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0128 Published 2021-09-16 No fix listed CWE-89

TI-2020-13766 CVE-2020-20122 · GHSA-xwp4-q27f-4wwf

Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in…

MEDIUM 45

Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0128 Published 2021-09-28 No fix listed CWE-89

TI-2018-14595 CVE-2018-20572 · GHSA-3h6h-v2q2-7mx9

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the…

MEDIUM 45

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01537 Published 2018-12-28 No fix listed CWE-89

TI-2018-08385 CVE-2018-11722 · GHSA-4h4g-p6p7-r67f

WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.

MEDIUM 45

WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01513 Published 2018-06-05 No fix listed CWE-89

TI-2018-08243 CVE-2018-11528 · GHSA-mgq2-pp95-vhxj

WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.

MEDIUM 45

WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01497 Published 2018-05-29 No fix listed CWE-89

TI-2022-10461 CVE-2022-27431 · GHSA-7cvg-hmpm-m53g

Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid…

MEDIUM 44

Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0108 Published 2022-05-04 No fix listed CWE-89

TI-2021-18358 CVE-2021-41654 · GHSA-63w8-jhm5-x9vp

SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute…

MEDIUM 44

SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0108 Published 2022-06-16 No fix listed CWE-89

TI-2021-17642 CVE-2021-40674 · GHSA-5qh7-579r-4mp6

An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in…

MEDIUM 44

An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in coreframe/app/order/admin/index.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01116 Published 2021-09-20 No fix listed CWE-89

TI-2020-13767 CVE-2020-20124 · GHSA-99g3-m7v3-fpm5

Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.

MEDIUM 43

Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02858 Published 2021-09-28 No fix listed CWE-94

TI-2018-07308 CVE-2018-10312 · GHSA-96gf-7r7p-g5gm

index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.

MEDIUM 43

index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02347 Published 2018-04-24 No fix listed CWE-352

TI-2018-07036 CVE-2018-9926 · GHSA-7cpf-mvv4-8843

An issue was discovered in WUZHI CMS 4.1.0.

MEDIUM 43

An issue was discovered in WUZHI CMS 4.1.0.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02927 Published 2018-04-10 No fix listed CWE-352

TI-2020-13643 CVE-2020-19551 · GHSA-h2qh-93xp-94xr

Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php…

MEDIUM 42

Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0176 Published 2021-09-21 No fix listed CWE-863

Open these records in search →