TI-2025-08984 CVE-2025-9795 · GHSA-mx5w-7wwg-47x7
xujeff tianti 天梯 UploadController.java ajaxUploadFile unrestricted upload
Priority MEDIUM 57
A vulnerability has been found in xujeff tianti 天梯 up to 2.3.
Vulnerabilities
10 records
TI-2025-08058 CVE-2025-8807 · GHSA-v27v-4mg3-gr66
xujeff tianti 天梯 save authorization
Priority MEDIUM 57
A vulnerability was found in xujeff tianti 天梯 up to 2.3.
TI-2025-20634 CVE-2025-27910 · GHSA-v888-xcc4-jmr2
tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…
Priority HIGH 70
tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status.
TI-2025-19178 CVE-2025-25908 · GHSA-p7rw-qw8q-g2rx
A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to…
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save.
TI-2025-19177 CVE-2025-25907 · GHSA-6cwg-xfh5-wxwq
tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…
Priority HIGH 73
tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save.
TI-2018-13549 CVE-2018-19110 · GHSA-3wmg-53g4-p9v4
The skin-management feature in tianti 2.3 allows remote authenticated users to bypass…
Priority LOW 31
The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a…
TI-2018-13548 CVE-2018-19109 · GHSA-734m-wgx8-qcgv
tianti 2.3 allows remote authenticated users to bypass intended permission restrictions…
Priority MEDIUM 42
tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/cms/column/list directly to read the column list page or edit a column.
TI-2018-13540 CVE-2018-19091 · GHSA-cmx8-9fx4-vp68
tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter.
Priority LOW 26
tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter.
TI-2018-13539 CVE-2018-19090 · GHSA-7grh-fc84-g3gv
tianti 2.3 has stored XSS in the article management module via an article title.
Priority LOW 26
tianti 2.3 has stored XSS in the article management module via an article title.
TI-2018-13538 CVE-2018-19089 · GHSA-r238-9672-36w7
tianti 2.3 has stored XSS in the userlist module via the…
Priority LOW 26
tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/save_role name parameter, which is mishandled in tianti-module-admin\src\main\webapp\WEB-INF\views\user\user_list.jsp.