Vulnerabilities

TI-2024-22029 CVE-2024-33350 · GHSA-xcg3-8p5h-wcf4

Directory Traversal vulnerability in TaoCMS v.3.0.2 allows a remote attacker to execute…

MEDIUM 52

Directory Traversal vulnerability in TaoCMS v.3.0.2 allows a remote attacker to execute arbitrary code and obtain sensitive information via the include/model/file.php component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01824 Published 2024-04-29 No fix listed CWE-22

TI-2023-17363 CVE-2023-34654 · GHSA-x44h-jr6p-888x

taocms <=3.0.2 is vulnerable to Cross Site Scripting (XSS).

MEDIUM 60

taocms <=3.0.2 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00505 Published 2023-07-05 No fix listed CWE-79

TI-2020-13920 CVE-2020-20725 · GHSA-xwm2-hpp5-jvvm

Cross Site Scripting vulnerability in taogogo taoCMS v.2.5 beta5.1 allows remote attacker…

MEDIUM 60

Cross Site Scripting vulnerability in taogogo taoCMS v.2.5 beta5.1 allows remote attacker to execute arbitrary code via the name field in admin.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00514 Published 2023-06-20 No fix listed CWE-79

TI-2023-01830 CVE-2023-1947 · GHSA-g365-ggc5-qmhx

taoCMS admin.php code injection

MEDIUM 44

A vulnerability was found in taoCMS 3.0.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01057 Published 2023-04-07 No fix listed CWE-94

TI-2021-13296 CVE-2021-34167 · GHSA-fc5j-rq29-6hmr

Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers…

HIGH 73

Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00423 Published 2023-02-24 No fix listed CWE-352

TI-2022-23776 CVE-2022-48006 · GHSA-whw6-xmjf-hj5f

An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute…

HIGH 82

An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00935 Published 2023-01-30 No fix listed CWE-434

TI-2022-23272 CVE-2022-46998 · GHSA-w93p-5fm2-hq67

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).

HIGH 82

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01154 Published 2023-01-25 No fix listed CWE-918

TI-2022-16623 CVE-2022-36261 · GHSA-88fv-rgr4-4rv7

An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows…

MEDIUM 42

An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&ctrl=del&path=/../../../test.txt

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01179 Published 2022-08-23 No fix listed CWE-22

TI-2022-16624 CVE-2022-36262 · GHSA-364p-6jx5-j5jv

An issue was discovered in taocms 3.0.2.

MEDIUM 46

An issue was discovered in taocms 3.0.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01927 Published 2022-08-15 No fix listed CWE-94

TI-2021-20327 CVE-2021-44915 · GHSA-p6vv-528x-4p42

Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category.

LOW 33

Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00942 Published 2022-07-05 No fix listed CWE-89

TI-2022-07872 CVE-2022-23880 · GHSA-fhhw-6x53-gxmq

An arbitrary file upload vulnerability in the File Management function module of taoCMS…

MEDIUM 46

An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01724 Published 2022-03-23 No fix listed CWE-434

TI-2022-09139 CVE-2022-25505 · GHSA-h4vp-6jj6-mq6g

Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id…

MEDIUM 44

Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0108 Published 2022-03-21 No fix listed CWE-89

TI-2022-09177 CVE-2022-25578 · GHSA-fg7x-cw25-mq65

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.

MEDIUM 46

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01803 Published 2022-03-18 No fix listed CWE-94

TI-2022-07471 CVE-2022-23380 · GHSA-m9cf-95pg-33mj

There is a SQL injection vulnerability in the background of taocms 3.0.2 in parameter id:action=admin&id=2&ctrl=edit.

MEDIUM 40

There is a SQL injection vulnerability in the background of taocms 3.0.2 in parameter id:action=admin&id=2&ctrl=edit.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0097 Published 2022-03-01 No fix listed CWE-89

TI-2021-20355 CVE-2021-44969 · GHSA-8wpm-73cm-3g25

Taocms v3.0.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Management Column component.

LOW 23

Taocms v3.0.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Management Column component.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00494 Published 2022-02-10 No fix listed CWE-79

TI-2021-20363 CVE-2021-44983 · GHSA-xxf3-jj8v-mccf

In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download…

LOW 25

In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01127 Published 2022-02-04 No fix listed CWE-552

TI-2022-07434 CVE-2022-23316 · GHSA-9493-8hw4-j4xf

An issue was discovered in taoCMS v3.0.2.

LOW 24

An issue was discovered in taoCMS v3.0.2.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01017 Published 2022-02-04 No fix listed CWE-552

TI-2021-21112 CVE-2021-46204 · GHSA-cw95-gwc8-vp9f

Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path…

MEDIUM 44

Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01094 Published 2022-01-19 No fix listed CWE-89

TI-2021-21111 CVE-2021-46203 · GHSA-jh95-qvfh-rjjw

Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter.

LOW 31

Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01058 Published 2022-01-19 No fix listed CWE-22

TI-2021-20374 CVE-2021-45015 · GHSA-26x4-q6jr-jj73

taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72.

MEDIUM 43

taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0177 Published 2021-12-14 No fix listed CWE-22

TI-2021-20373 CVE-2021-45014 · GHSA-7957-q3ch-3v25

There is an upload sql injection vulnerability in the background of taocms 3.0.2 in…

MEDIUM 44

There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&id=26

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01116 Published 2021-12-14 No fix listed CWE-89

TI-2021-07867 CVE-2021-25785 · GHSA-gh7q-h8q2-hp4j

Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via…

LOW 23

Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management column.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00589 Published 2021-12-02 No fix listed CWE-79

TI-2021-07866 CVE-2021-25784 · GHSA-5fx7-rr4q-mjpx

Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article.

LOW 34

Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01134 Published 2021-12-02 No fix listed CWE-89

TI-2021-07865 CVE-2021-25783 · GHSA-8cr9-rq58-w482

Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search.

LOW 34

Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01134 Published 2021-12-02 No fix listed CWE-89

TI-2019-05437 CVE-2019-7720 · GHSA-63pw-526x-mrr6

taocms through 2014-05-24 allows eval injection by placing PHP code in the install.php…

MEDIUM 45

taocms through 2014-05-24 allows eval injection by placing PHP code in the install.php db_name parameter and then making a config.php request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01607 Published 2019-02-11 No fix listed CWE-94

Vulnerabilities

Filters