Priority HIGH 72
PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.01102 · Published 2025-12-10 · No fix listed CWE-94
Priority LOW 36
PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02037 · Published 2023-12-14 · No fix listed
Priority LOW 28
A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00509 · Published 2023-11-01 · No fix listed CWE-79
Priority HIGH 73
PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00811 · Published 2023-01-19 · No fix listed CWE-434
Priority LOW 20
Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00361 · Published 2021-08-25 · No fix listed CWE-352
Priority LOW 31
Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01211 · Published 2021-08-25 · No fix listed CWE-22
Priority LOW 25
Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00516 · Published 2021-08-25 · No fix listed CWE-79
Priority LOW 29
A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the E-Mail field.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00782 · Published 2021-08-06 · No fix listed CWE-79
Priority LOW 26
An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when 'name = "file" is deleted during file uploads.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00897 · Published 2021-08-06 · No fix listed CWE-668
Priority LOW 28
PopojiCMS 2.0.1 allows refer= Open Redirection.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00707 · Published 2019-11-07 · No fix listed CWE-601
Priority LOW 29
po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post[1][content]= stored XSS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00812 · Published 2019-11-07 · No fix listed CWE-79
Priority LOW 39
An issue was discovered in PopojiCMS v2.0.1.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.0065 · Published 2019-03-03 · No fix listed CWE-352
Priority LOW 38
An issue was discovered in PopojiCMS v2.0.1.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02506 · Published 2018-11-05 · No fix listed CWE-22
Priority LOW 39
An issue was discovered in PopojiCMS v2.0.1.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00587 · Published 2018-11-05 · No fix listed CWE-352
Priority MEDIUM 44
An issue was discovered in PopojiCMS v2.0.1.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00812 · Published 2018-11-05 · No fix listed CWE-352
THREATIST.IORead the docs