Vulnerabilities

TI-2025-19134 CVE-2025-25772 · GHSA-r4wq-76x5-pwj9

A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms…

LOW 22

A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted request.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00172 Published 2025-02-21 No fix listed CWE-352

TI-2024-01171 CVE-2024-1257 · GHSA-rwrp-rr8g-cg9q

Jspxcms find_text.do cross site scripting

MEDIUM 60

A vulnerability was found in Jspxcms 10.2.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00454 Published 2024-02-06 No fix listed CWE-79

TI-2024-01170 CVE-2024-1256 · GHSA-2c82-fg6w-rjhp

Jspxcms filter_text.do cross site scripting

LOW 21

A vulnerability was found in Jspxcms 10.2.0 and classified as problematic.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00551 Published 2024-02-06 No fix listed CWE-79

TI-2024-00555 CVE-2024-0599 · GHSA-4j3q-m6c3-7fq3

Jspxcms Document Management Page InfoController.java cross site scripting

MEDIUM 58

A vulnerability was found in Jspxcms 10.2.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00514 Published 2024-01-16 No fix listed CWE-79

TI-2022-10904 CVE-2022-28090 · GHSA-fq6m-725p-m7wr

Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via…

LOW 31

Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01068 Published 2022-05-04 No fix listed CWE-918

TI-2022-07442 CVE-2022-23329 · GHSA-mgq8-cgrr-q7fj

A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0…

MEDIUM 57

A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.1441 Published 2022-02-04 No fix listed CWE-434