Vulnerabilities

TI-2025-03520 CVE-2025-3977 · GHSA-77gx-3fxf-6gxj

iteachyou Dreamer CMS Attachment download improper authorization

MEDIUM 57

A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00373 Published 2025-04-27 No fix listed CWE-266

TI-2025-01334 CVE-2025-1548 · GHSA-chfj-fxfr-5gj5

iteachyou Dreamer CMS edit cross site scripting

MEDIUM 56

A vulnerability was found in iteachyou Dreamer CMS 4.1.3.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00349 Published 2025-02-21 No fix listed CWE-79

TI-2025-01329 CVE-2025-1543 · GHSA-j22r-rxv9-h8pm

iteachyou Dreamer CMS ueditor-1.4.3.3 path traversal

MEDIUM 57

A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00764 Published 2025-02-21 No fix listed CWE-22

TI-2024-03103 CVE-2024-3311 · GHSA-96rw-9jfw-gw2m

Dreamer CMS ThemesController.java ZipUtils.unZipFiles path traversal

HIGH 71

A vulnerability was found in Dreamer CMS up to 4.1.3.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01016 Published 2024-04-04 No fix listed CWE-22

TI-2024-02920 CVE-2024-3118 · GHSA-ghvx-2mcc-5rwp

Dreamer CMS Attachment permission

LOW 39

A vulnerability, which was classified as critical, has been found in Dreamer CMS up to 4.1.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00802 Published 2024-03-31 No fix listed CWE-275

TI-2024-02189 CVE-2024-2354 · GHSA-mqwf-p679-m69g

Dreamer CMS toEdit cross-site request forgery

MEDIUM 62

A vulnerability, which was classified as problematic, was found in Dreamer CMS 4.1.3.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00299 Published 2024-03-10 No fix listed CWE-352

TI-2024-16954 CVE-2024-25811 · GHSA-mm2p-hcgv-77p3

An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information.

MEDIUM 62

An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00581 Published 2024-02-29 No fix listed CWE-284

TI-2023-06486 CVE-2023-7091 · GHSA-w4vp-36w6-qc4q

Dreamer CMS uploadFile unrestricted upload

MEDIUM 40

A vulnerability was found in Dreamer CMS 4.1.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00885 Published 2023-12-24 No fix listed CWE-434

TI-2023-27361 CVE-2023-50017 · GHSA-8x4c-6c7p-x5wp

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…

LOW 38

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00364 Published 2023-12-14 No fix listed CWE-352

TI-2023-27030 CVE-2023-49484 · GHSA-4825-mcr8-6gqj

Dreamer CMS v4.1.3 was discovered to contain a cross-site scripting (XSS) vulnerability…

LOW 25

Dreamer CMS v4.1.3 was discovered to contain a cross-site scripting (XSS) vulnerability in the article management department.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00434 Published 2023-12-08 No fix listed CWE-79

TI-2023-26683 CVE-2023-48914 · GHSA-6p8x-45xh-rcvq

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.

LOW 38

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0036 Published 2023-11-30 No fix listed CWE-352

TI-2023-26682 CVE-2023-48913 · GHSA-832q-jjgp-rmrx

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…

LOW 38

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0036 Published 2023-11-30 No fix listed CWE-352

TI-2023-26681 CVE-2023-48912 · GHSA-q9px-83q2-6hjr

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.

HIGH 73

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0036 Published 2023-11-30 No fix listed CWE-352

TI-2023-25325 CVE-2023-46887 · GHSA-v46f-6x32-qw44

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.

HIGH 72

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00292 Published 2023-11-29 No fix listed CWE-494

TI-2023-25324 CVE-2023-46886 · GHSA-5rqj-g24x-g4wv

Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal.

HIGH 80

Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00992 Published 2023-11-29 No fix listed CWE-22

TI-2023-25999 CVE-2023-48017 · GHSA-2x7x-86wq-p8fq

Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions…

MEDIUM 40

Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00353 Published 2023-11-18 No fix listed CWE-352

TI-2023-26001 CVE-2023-48021 · GHSA-7j7r-3hfp-h2h7

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00356 Published 2023-11-14 No fix listed CWE-352

TI-2023-26000 CVE-2023-48020 · GHSA-m6rf-6fjq-59j6

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF)…

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00356 Published 2023-11-14 No fix listed CWE-352

TI-2023-26022 CVE-2023-48063 · GHSA-7m4h-4frj-xvm5

An issue was discovered in dreamer_cms 4.1.3.

LOW 20

An issue was discovered in dreamer_cms 4.1.3.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00247 Published 2023-11-13 No fix listed CWE-352

TI-2023-26021 CVE-2023-48060 · GHSA-r24p-5gqm-pc2r

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00364 Published 2023-11-13 No fix listed CWE-352

TI-2023-26020 CVE-2023-48058 · GHSA-5prh-qxfc-v7vp

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00364 Published 2023-11-13 No fix listed CWE-352

TI-2023-24653 CVE-2023-45907 · GHSA-xc8p-j5f8-7w98

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00376 Published 2023-10-17 No fix listed CWE-352

TI-2023-24652 CVE-2023-45906 · GHSA-qgg9-7g95-6v4j

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add.

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00376 Published 2023-10-17 No fix listed CWE-352

TI-2023-24651 CVE-2023-45905 · GHSA-9jm9-9xjf-h3x2

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add.

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00376 Published 2023-10-17 No fix listed CWE-352

TI-2023-24650 CVE-2023-45904 · GHSA-433v-4977-67pv

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update.

MEDIUM 40

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00376 Published 2023-10-17 No fix listed CWE-352

Vulnerabilities

Filters