Vulnerabilities

TI-2020-13930 CVE-2020-20799 · GHSA-7grc-h894-wvp2

JeeCMS 1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows…

LOW 25

JeeCMS 1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the commentText parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00503 Published 2021-09-30 No fix listed CWE-79

TI-2018-14555 CVE-2018-20528 · GHSA-7g25-wrwr-v7hm

JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter.

LOW 31

JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01047 Published 2018-12-27 No fix listed CWE-918

TI-2018-13843 CVE-2018-19545 · GHSA-cp47-g8rf-6xj7

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user.

LOW 39

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00494 Published 2018-11-26 No fix listed CWE-352

TI-2018-13842 CVE-2018-19544 · GHSA-mjgh-6cg9-7rxw

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.

LOW 29

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00422 Published 2018-11-26 No fix listed CWE-352

TI-2018-13427 CVE-2018-18952 · GHSA-j433-xfvg-4237

JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI.

LOW 23

JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00642 Published 2018-11-05 No fix listed CWE-79

Vulnerabilities

Filters

JeeCMS 1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows…

JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter.

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user.

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.

JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI.