Vulnerabilities

TI-2026-03284 CVE-2026-3795 · GHSA-r9h9-fgfp-v4m4

doramart DoraCMS v1.js createFileBypath path traversal

LOW 25

A security flaw has been discovered in doramart DoraCMS 3.0.x.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00724 Published 2026-03-09 No fix listed CWE-22

TI-2026-03283 CVE-2026-3794 · GHSA-wvj6-8496-wm9r

doramart DoraCMS Email API send improper authentication

LOW 32

A vulnerability was identified in doramart DoraCMS 3.0.x.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0072 Published 2026-03-09 No fix listed CWE-287

TI-2024-18960 CVE-2024-28715 · GHSA-9v27-xwh4-23q8

Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker…

MEDIUM 40

Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01071 Published 2024-03-19 No fix listed CWE-79

TI-2023-28442 CVE-2023-51840 · GHSA-555g-cg2q-wmc3

DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.

MEDIUM 50

DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00621 Published 2024-01-29 No fix listed CWE-798

TI-2023-27015 CVE-2023-49444 · GHSA-4398-q7v4-m5w6

An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute…

LOW 25

An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0051 Published 2023-12-08 No fix listed CWE-79

TI-2023-27014 CVE-2023-49443 · GHSA-9w2m-c6wc-48q6

DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames…

MEDIUM 44

DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00815 Published 2023-12-08 No fix listed CWE-307

TI-2022-15861 CVE-2022-35147 · GHSA-j35r-fv44-887q

DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.

MEDIUM 45

DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01531 Published 2022-08-17 No fix listed CWE-200

TI-2022-09117 CVE-2022-25464 · GHSA-2g46-j24g-qvf7

A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of…

LOW 22

A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00442 Published 2022-03-20 No fix listed CWE-79

TI-2020-13349 CVE-2020-18220 · GHSA-6pr6-2grv-9mc6

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain…

LOW 33

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susce…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00412 Published 2021-05-20 No fix listed CWE-326

TI-2018-11909 CVE-2018-16622 · GHSA-jmm7-j5h8-qc7p

Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS…

LOW 26

Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/u…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00788 Published 2018-09-06 No fix listed CWE-79

Vulnerabilities

Filters