Vulnerabilities

TI-2025-32088 CVE-2025-50229 · GHSA-8r77-j8hp-jvhf

Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.

HIGH 82

Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00359 Published 2026-04-23 No fix listed CWE-89

TI-2025-32087 CVE-2025-50228 · GHSA-3hh3-hx7r-ggc2

Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.

MEDIUM 47

Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00286 Published 2026-04-09 No fix listed CWE-918

TI-2026-23388 CVE-2026-29840 · GHSA-ffqv-44jp-mf9x

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in…

LOW 24

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserController.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00171 Published 2026-03-24 No fix listed CWE-79

TI-2026-02843 CVE-2026-3292 · GHSA-rwvh-hmmf-wpqx

jizhiCMS Batch Model.php findAll sql injection

MEDIUM 57

A security vulnerability has been detected in jizhiCMS up to 2.5.6.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.005 Published 2026-02-27 No fix listed CWE-74

TI-2025-43110 CVE-2025-70397 · GHSA-hxj5-g9j8-xgph

jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.

HIGH 67

jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00357 Published 2026-02-17 No fix listed CWE-89

TI-2020-19252 CVE-2020-37117 · GHSA-m4vr-wgxw-jjm6

jizhiCMS 1.6.7 - Arbitrary File Download

HIGH 72

jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00817 Published 2026-02-05 No fix listed CWE-434

TI-2025-12804 CVE-2025-14013 · GHSA-vhh7-7r7h-8w8g

JIZHICMS Comment addcomment.html cross site scripting

MEDIUM 57

A vulnerability was identified in JIZHICMS up to 2.5.5.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00304 Published 2025-12-04 No fix listed CWE-79

TI-2025-12803 CVE-2025-14012 · GHSA-m282-p3vv-884c

JIZHICMS Batch Delete Comments deleteAll.html delete sql injection

MEDIUM 58

A vulnerability was determined in JIZHICMS up to 2.5.5.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00415 Published 2025-12-04 No fix listed CWE-74

TI-2025-12802 CVE-2025-14011 · GHSA-55cq-ghm5-hggm

JIZHICMS Add Display Name Field addcomment.html commentlist sql injection

MEDIUM 58

A vulnerability was found in JIZHICMS up to 2.5.5.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00415 Published 2025-12-04 No fix listed CWE-74

TI-2025-02305 CVE-2025-2639 · GHSA-847c-3v8q-4f53

JIZHICMS Article release.html improper authorization

MEDIUM 57

A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00413 Published 2025-03-23 No fix listed CWE-266

TI-2025-02304 CVE-2025-2638 · GHSA-qf7v-7r35-cmj2

JIZHICMS Article release.html improper authorization

MEDIUM 57

A vulnerability, which was classified as problematic, was found in JIZHICMS up to 1.7.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00413 Published 2025-03-23 No fix listed CWE-266

TI-2025-02303 CVE-2025-2637 · GHSA-vw9q-rqcg-vpfw

JIZHICMS Account Profile Page userinfo.html improper authorization

MEDIUM 57

A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00441 Published 2025-03-23 No fix listed CWE-266

TI-2025-19141 CVE-2025-25785 · GHSA-xmg6-qg4m-gw97

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the…

MEDIUM 48

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00441 Published 2025-02-26 No fix listed CWE-918

TI-2025-19140 CVE-2025-25784 · GHSA-xg6j-fjj2-gv89

An arbitrary file upload vulnerability in the component \c\TemplateController.php of…

HIGH 82

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0092 Published 2025-02-26 No fix listed CWE-434

TI-2024-22660 CVE-2024-34255 · GHSA-g8rr-54r4-95mg

jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function.

LOW 27

jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00261 Published 2024-05-08 No fix listed CWE-79

TI-2024-22024 CVE-2024-33338 · GHSA-fj42-xxpf-rw8p

Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain…

LOW 34

Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00971 Published 2024-04-29 No fix listed CWE-79

TI-2024-21227 CVE-2024-32161 · GHSA-6ppw-252q-r2mf

jizhiCMS 2.5 suffers from a File upload vulnerability.

MEDIUM 44

jizhiCMS 2.5 suffers from a File upload vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00717 Published 2024-04-17 No fix listed CWE-434

TI-2023-27954 CVE-2023-51154 · GHSA-59j2-44h9-8h98

Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the…

HIGH 75

Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00612 Published 2024-01-04 No fix listed CWE-200

TI-2023-27644 CVE-2023-50692 · GHSA-vpcq-h894-5962

File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary…

HIGH 77

File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00938 Published 2023-12-28 No fix listed CWE-434

TI-2023-23516 CVE-2023-43836 · GHSA-684c-fmh3-cpgp

There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information

MEDIUM 62

There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00729 Published 2023-10-02 No fix listed CWE-89

TI-2023-20208 CVE-2023-38948 · GHSA-p39h-6928-4fq5

An arbitrary file download vulnerability in the /c/PluginsController.php component of…

HIGH 67

An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00951 Published 2023-08-03 No fix listed CWE-552

TI-2023-02743 CVE-2023-2927 · GHSA-r3gq-r28g-g674

JIZHICMS TemplateController.php index server-side request forgery

MEDIUM 44

A vulnerability was found in JIZHICMS 2.4.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00867 Published 2023-05-27 No fix listed CWE-918

TI-2023-15247 CVE-2023-31862 · GHSA-g4xp-6mr2-c9p8

jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS).

MEDIUM 58

jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00343 Published 2023-05-19 No fix listed CWE-79

TI-2023-11990 CVE-2023-27235 · GHSA-8w2v-gr86-9vf3

An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of…

HIGH 67

An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00951 Published 2023-03-15 No fix listed CWE-434

TI-2023-11989 CVE-2023-27234 · GHSA-gxfc-624w-5q2v

A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows…

MEDIUM 62

A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00282 Published 2023-03-15 No fix listed CWE-352

Vulnerabilities

Filters