Vulnerabilities

TI-2024-32361 CVE-2024-48341 · GHSA-76gq-jjh6-68rh

dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…

MEDIUM 51

dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00169 Published 2025-09-08 No fix listed CWE-352

TI-2025-20716 CVE-2025-28100 · GHSA-98g5-ch9p-4pc6

A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute…

HIGH 82

A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at the "operateOrder.php" id parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00652 Published 2025-04-15 No fix listed CWE-89

TI-2024-34065 CVE-2024-50652 · GHSA-qgrx-3ff6-vw5g

A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files…

MEDIUM 61

A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00307 Published 2024-11-15 No fix listed CWE-434

TI-2024-34064 CVE-2024-50651 · GHSA-cxr4-643w-mfv3

java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain…

MEDIUM 62

java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00497 Published 2024-11-15 No fix listed CWE-639

TI-2024-07697 CVE-2024-8302 · GHSA-3g89-46wx-prw3

dingfanzu CMS chpwd.php sql injection

MEDIUM 57

A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00752 Published 2024-08-29 No fix listed CWE-89