Vulnerabilities

TI-2020-18932 CVE-2020-36763 · GHSA-w2gw-6xj9-wg4r

Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00486 Published 2023-07-31 No fix listed CWE-79

TI-2020-14197 CVE-2020-21881 · GHSA-6gfh-pmhw-xg5r

Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote…

MEDIUM 62

Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify application data via article/admin/content/add.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0034 Published 2023-07-31 No fix listed CWE-352

TI-2020-14195 CVE-2020-21862 · GHSA-vhjr-xhj8-wrqr

Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBackup/del.

HIGH 70

Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBackup/del.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00962 Published 2023-07-06 No fix listed CWE-22

TI-2020-14194 CVE-2020-21861 · GHSA-cxvj-gmrx-gjv8

File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/upload.

HIGH 73

File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/upload.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0071 Published 2023-07-06 No fix listed CWE-434

TI-2020-18808 CVE-2020-36610 · GHSA-w2pm-6h2c-v8hw

annyshow DuxCMS cross-site request forgery

HIGH 68

A vulnerability was found in annyshow DuxCMS 2.1.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00486 Published 2022-12-08 No fix listed CWE-863

TI-2020-18807 CVE-2020-36609 · GHSA-37qx-46xm-x54w

annyshow DuxCMS Article edit cross site scripting

MEDIUM 58

A vulnerability was found in annyshow DuxCMS 2.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00412 Published 2022-12-08 No fix listed CWE-707

TI-2021-02282 CVE-2021-3242 · GHSA-rq46-c763-3946

DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=.

MEDIUM 45

DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01227 Published 2022-02-16 No fix listed CWE-89

Vulnerabilities

Filters

Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run…

Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote…

Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBackup/del.

File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/upload.

annyshow DuxCMS cross-site request forgery

annyshow DuxCMS Article edit cross site scripting

DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=.