TI-2026-02546 CVE-2026-2954 · GHSA-96mq-76jj-h8p9
Dromara UJCMS ImportDataController import-channel importChanel injection
Priority MEDIUM 57
A vulnerability was found in Dromara UJCMS 10.0.2.
Vulnerabilities
14 records
TI-2026-02545 CVE-2026-2953 · GHSA-5qxq-p7xm-75w5
Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal
Priority MEDIUM 57
A vulnerability has been found in Dromara UJCMS 101.2.
TI-2025-02166 CVE-2025-2491 · GHSA-j5w5-3c3j-vg23
Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting
Priority MEDIUM 55
A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5.
TI-2025-02165 CVE-2025-2490 · GHSA-2fm6-qmmh-8rv2
Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting
Priority LOW 22
A vulnerability was found in Dromara ujcms 9.7.5.
TI-2024-36837 CVE-2024-55452 · GHSA-5vhj-65c8-9r9j
A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs…
Priority MEDIUM 58
A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items.
TI-2024-36836 CVE-2024-55451 · GHSA-f3g2-9hcq-jr47
A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload…
Priority MEDIUM 55
A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3.
TI-2024-11583 CVE-2024-12483 · GHSA-v8gj-rjxc-h27w
Dromara UJCMS User ID id authorization
Priority LOW 34
A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3.
TI-2023-28430 CVE-2023-51806 · GHSA-58jj-f9fm-h5qv
File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.
Priority LOW 37
File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.
TI-2023-28010 CVE-2023-51350 · GHSA-2w86-wv37-w7h5
A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive…
Priority HIGH 82
A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-For function in the header.
TI-2023-03027 CVE-2023-3231 · GHSA-2f4f-h5m8-27v8
UJCMS ZIP Package information disclosure
Priority LOW 30
A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic.
TI-2023-17428 CVE-2023-34878 · GHSA-mgj3-4cvf-j637
An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information…
Priority MEDIUM 40
An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip.
TI-2023-17422 CVE-2023-34865 · GHSA-cw7f-mrgf-5rg9
Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.
Priority HIGH 82
Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.
TI-2023-17383 CVE-2023-34747 · GHSA-m62m-mvwc-xq5v
File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.
Priority HIGH 75
File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.
TI-2023-09993 CVE-2023-24369 · GHSA-xr6w-643f-4rpc
A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute…
Priority MEDIUM 60
A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter under the Add New Articles function.