Vulnerabilities

TI-2025-01341 CVE-2025-1557 · GHSA-3hx8-jcjc-x9xm

OFCMS cross-site request forgery

MEDIUM 57

A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00293 Published 2025-02-22 No fix listed CWE-352

TI-2024-32323 CVE-2024-48236 · GHSA-x467-hf2h-75gq

An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the…

MEDIUM 64

An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of the ofcms-admin\src\main\java\com\ofsoft\cms\core\uitle\FileUtils.java file

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00735 Published 2024-10-25 No fix listed CWE-94

TI-2024-32322 CVE-2024-48235 · GHSA-v7p7-p2fq-44fh

An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save…

MEDIUM 64

An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00735 Published 2024-10-25 No fix listed CWE-94

TI-2024-08732 CVE-2024-9411 · GHSA-pggh-h238-4qvj

OFCMS add.json add cross site scripting

MEDIUM 57

A vulnerability classified as problematic has been found in OFCMS 1.1.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00367 Published 2024-10-01 No fix listed CWE-79

TI-2024-22661 CVE-2024-34256 · GHSA-2g58-2x39-qh45

OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.

HIGH 82

OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00654 Published 2024-05-14 No fix listed CWE-89

TI-2023-28431 CVE-2023-51807 · GHSA-cqrq-pcmc-2376

Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain…

LOW 25

Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0045 Published 2024-01-16 No fix listed CWE-79

TI-2023-10284 CVE-2023-24760 · GHSA-vx8v-3pw3-vg52

An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via…

MEDIUM 42

An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00842 Published 2023-03-16 No fix listed CWE-269

TI-2022-12080 CVE-2022-29653 · GHSA-hm52-fmcr-vp69

OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the…

LOW 28

OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00578 Published 2022-05-31 No fix listed CWE-79

TI-2022-10822 CVE-2022-27961 · GHSA-x244-746v-9wx6

A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows…

LOW 25

A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment text box.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00436 Published 2022-04-10 No fix listed CWE-79

TI-2022-10821 CVE-2022-27960 · GHSA-7j2x-68p3-rh6g

Insecure permissions configured in the user_id parameter at SysUserController.java of…

LOW 25

Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' personal information.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00466 Published 2022-04-10 No fix listed CWE-276

TI-2019-07034 CVE-2019-9617 · GHSA-43r8-qvvq-25fr