Vulnerabilities

TI-2026-02840 CVE-2026-3289 · GHSA-pw4j-xhwf-vgmr

Sanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversal

MEDIUM 63

A weakness has been identified in Sanluan PublicCMS 6.202506.d.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00755 Published 2026-02-27 No fix listed CWE-22

TI-2025-42871 CVE-2025-69437 · GHSA-5vcj-3qv7-j6hw

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS.

HIGH 71

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00399 Published 2026-02-27 No fix listed CWE-79

TI-2026-01667 CVE-2026-2010 · GHSA-52jq-ww84-hqvp

Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization

MEDIUM 45

A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.0036 Published 2026-02-06 No fix listed CWE-266

TI-2026-00841 CVE-2026-1112 · GHSA-hp5r-hrqw-jp8g

Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization

MEDIUM 57

A vulnerability was found in Sanluan PublicCMS up to 5.202506.d.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00428 Published 2026-01-18 No fix listed CWE-266

TI-2026-00840 CVE-2026-1111 · GHSA-jc4q-h995-9f9w

Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal

MEDIUM 56

A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00696 Published 2026-01-18 No fix listed CWE-22

TI-2025-40475 CVE-2025-65837 · GHSA-3xrv-whx5-r4gj

PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.

MEDIUM 58

PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0017 Published 2025-12-22 No fix listed CWE-79

TI-2025-40477 CVE-2025-65840 · GHSA-3r6c-pmc8-q2xj

PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.

HIGH 73

PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00188 Published 2025-12-01 No fix listed CWE-352

TI-2025-40476 CVE-2025-65838 · GHSA-cgqr-v3c9-4f9g

PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.

HIGH 72

PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00477 Published 2025-12-01 No fix listed CWE-22

TI-2025-40474 CVE-2025-65836 · GHSA-5xch-82fp-5j4w

PublicCMS V5.202506.b is vulnerable to SSRF.

HIGH 80

PublicCMS V5.202506.b is vulnerable to SSRF.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00353 Published 2025-12-01 No fix listed CWE-918

TI-2025-35555 CVE-2025-57516 · GHSA-7953-4j2w-78x6

OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and…

HIGH 77

OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01147 Published 2025-09-29 No fix listed CWE-78

TI-2025-07275 CVE-2025-7953 · GHSA-xw33-rcw2-jhhm

Sanluan PublicCMS viewer.html redirect

LOW 23

A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00388 Published 2025-07-22 No fix listed CWE-601

TI-2025-07271 CVE-2025-7949 · GHSA-rmjh-hr29-qjfc

Sanluan PublicCMS preview.html redirect

MEDIUM 56

A vulnerability was found in Sanluan PublicCMS up to 5.202506.a.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00371 Published 2025-07-22 No fix listed CWE-601

TI-2025-18979 CVE-2025-25361 · GHSA-r7j7-c9pj-h2v7

An arbitrary file upload vulnerability in the component…

HIGH 82

An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00709 Published 2025-03-06 No fix listed CWE-434

TI-2024-10351 CVE-2024-11175 · GHSA-5fjh-75hm-33xj

Public CMS Voting Management save cross site scripting

MEDIUM 57

A vulnerability was found in Public CMS 5.202406.d and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0052 Published 2024-11-13 No fix listed CWE-79

TI-2024-10258 CVE-2024-11070 · GHSA-p624-h99j-mw37

Sanluan PublicCMS Tag Type save cross site scripting

MEDIUM 57

A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00401 Published 2024-11-11 No fix listed CWE-79

TI-2024-30954 CVE-2024-46410 · GHSA-qhpm-38cp-fphg

PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS)…

MEDIUM 55

PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0031 Published 2024-10-08 No fix listed CWE-79

TI-2024-28483 CVE-2024-42523 · GHSA-jj85-4qm9-xvwg

publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData

HIGH 67

publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0051 Published 2024-08-23 No fix listed CWE-434

TI-2024-26998 CVE-2024-40552 · GHSA-qqr6-x9qh-69fr

PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE)…

MEDIUM 41

PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00721 Published 2024-07-12 No fix listed CWE-94

TI-2024-26997 CVE-2024-40551 · GHSA-xggj-q3f4-jxvm

An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of…

HIGH 71

An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00423 Published 2024-07-12 No fix listed CWE-434

TI-2024-26996 CVE-2024-40550 · GHSA-3p96-wrm7-xc3m

An arbitrary file upload vulnerability in the component…

MEDIUM 42

An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00989 Published 2024-07-12 No fix listed CWE-22

TI-2024-26995 CVE-2024-40549 · GHSA-jcc8-9r23-vj32

An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of…

HIGH 73

An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00667 Published 2024-07-12 No fix listed CWE-434

TI-2024-26994 CVE-2024-40548 · GHSA-5gjc-jp5m-cj3c

An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of…

HIGH 73

An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00667 Published 2024-07-12 No fix listed CWE-434

TI-2024-26993 CVE-2024-40547 · GHSA-f6x2-m86h-4v8w

PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement…

MEDIUM 62

PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00328 Published 2024-07-12 No fix listed CWE-284

TI-2024-26992 CVE-2024-40546 · GHSA-vh2v-jjwq-3c7m

An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of…

HIGH 73

An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00721 Published 2024-07-12 No fix listed CWE-94

TI-2024-26991 CVE-2024-40545 · GHSA-hcj2-p7x3-3jmm

An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of…

MEDIUM 41

An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00661 Published 2024-07-12 No fix listed CWE-434

Vulnerabilities

Filters