Vulnerabilities

TI-2026-84847 CVE-2026-121583 · GHSA-mr5q-563w-gq7x

Authorization bypass in Sanluan PublicCMS payment refund service

LOW 24

A vulnerability was identified in Sanluan PublicCMS 5.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00285 Published 2026-11-03 No fix listed CWE-285

TI-2026-83671 CVE-2026-120319 · GHSA-2xhq-9mxg-mc67

Authorization bypass in Sanluan PublicCMS trade refund update

LOW 24

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00269 Published 2026-11-02 No fix listed CWE-285

TI-2026-71997 CVE-2026-110113 · GHSA-vpf9-h2mx-wqjf

PublicCMS IDOR lets members edit other members' addresses

MEDIUM 57

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping address…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00299 Published 2026-10-13 No fix listed CWE-639

TI-2026-64266 CVE-2026-97721 · GHSA-jg6q-p698-x96g

Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization

MEDIUM 56

A weakness has been identified in Sanluan PublicCMS up to 6.202506.e.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00236 Published 2026-09-25 No fix listed CWE-285

TI-2026-07682 CVE-2026-8740 · GHSA-pqmw-x4mq-chh8

Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine

LOW 24

A flaw has been found in Sanluan PublicCMS 5.202506.d.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00232 Published 2026-05-17 No fix listed CWE-1336

TI-2026-07681 CVE-2026-8739 · GHSA-2352-54f8-q7h5

Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key

HIGH 70

A vulnerability was detected in Sanluan PublicCMS 5.202506.d.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00281 Published 2026-05-17 No fix listed CWE-320

TI-2026-07680 CVE-2026-8738 · GHSA-9g77-xx5j-qgfr

Sanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error

LOW 36

A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00331 Published 2026-05-17 No fix listed CWE-840

TI-2026-07679 CVE-2026-8737 · GHSA-cm9c-h987-49f4

Sanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authentication

HIGH 70

A weakness has been identified in Sanluan PublicCMS 5.202506.d.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00403 Published 2026-05-17 No fix listed CWE-287

TI-2026-05961 CVE-2026-6797 · GHSA-f82q-cjhg-c837

Sanluan PublicCMS DocToHtmlUtils.java ZipSecureFile.setMinflateRatio resource consumption

LOW 24

A vulnerability was identified in Sanluan PublicCMS up to 6.202506.d.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00267 Published 2026-04-21 No fix listed CWE-400

TI-2026-05960 CVE-2026-6796 · GHSA-crfw-8vvm-pm25

Sanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file

LOW 23

A vulnerability was determined in Sanluan PublicCMS up to 6.202506.d.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00147 Published 2026-04-21 No fix listed CWE-312

TI-2026-05250 CVE-2026-5987 · GHSA-v5c9-pmxr-9vhc

Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java…

MEDIUM 56

A security vulnerability has been detected in Sanluan PublicCMS up to 6.202506.d.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00248 Published 2026-04-09 No fix listed CWE-1336

TI-2026-02840 CVE-2026-3289 · GHSA-pw4j-xhwf-vgmr

Sanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversal

MEDIUM 63

A weakness has been identified in Sanluan PublicCMS 6.202506.d.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00755 Published 2026-02-27 No fix listed CWE-22

TI-2025-42871 CVE-2025-69437 · GHSA-5vcj-3qv7-j6hw

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS.

HIGH 71

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00399 Published 2026-02-27 No fix listed CWE-79

TI-2026-01667 CVE-2026-2010 · GHSA-52jq-ww84-hqvp

Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization

MEDIUM 45

A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.0036 Published 2026-02-06 No fix listed CWE-266

TI-2026-00841 CVE-2026-1112 · GHSA-hp5r-hrqw-jp8g

Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization

MEDIUM 57

A vulnerability was found in Sanluan PublicCMS up to 5.202506.d.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00428 Published 2026-01-18 No fix listed CWE-266

TI-2026-00840 CVE-2026-1111 · GHSA-jc4q-h995-9f9w

Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal

MEDIUM 56

A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00696 Published 2026-01-18 No fix listed CWE-22

TI-2025-40475 CVE-2025-65837 · GHSA-3xrv-whx5-r4gj

PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.

MEDIUM 58

PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0017 Published 2025-12-22 No fix listed CWE-79

TI-2025-40477 CVE-2025-65840 · GHSA-3r6c-pmc8-q2xj

PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.

HIGH 73

PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00188 Published 2025-12-01 No fix listed CWE-352

TI-2025-40476 CVE-2025-65838 · GHSA-cgqr-v3c9-4f9g

PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.

HIGH 72

PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00477 Published 2025-12-01 No fix listed CWE-22

TI-2025-40474 CVE-2025-65836 · GHSA-5xch-82fp-5j4w

PublicCMS V5.202506.b is vulnerable to SSRF.

HIGH 80

PublicCMS V5.202506.b is vulnerable to SSRF.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00353 Published 2025-12-01 No fix listed CWE-918

TI-2025-35555 CVE-2025-57516 · GHSA-7953-4j2w-78x6

OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and…

HIGH 77

OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01147 Published 2025-09-29 No fix listed CWE-78

TI-2025-07275 CVE-2025-7953 · GHSA-xw33-rcw2-jhhm

Sanluan PublicCMS viewer.html redirect

LOW 23

A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00388 Published 2025-07-22 No fix listed CWE-601

TI-2025-07271 CVE-2025-7949 · GHSA-rmjh-hr29-qjfc

Sanluan PublicCMS preview.html redirect

MEDIUM 56

A vulnerability was found in Sanluan PublicCMS up to 5.202506.a.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00371 Published 2025-07-22 No fix listed CWE-601

TI-2025-18979 CVE-2025-25361 · GHSA-r7j7-c9pj-h2v7

An arbitrary file upload vulnerability in the component…

HIGH 82

An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00709 Published 2025-03-06 No fix listed CWE-434

TI-2024-10351 CVE-2024-11175 · GHSA-5fjh-75hm-33xj

Public CMS Voting Management save cross site scripting

MEDIUM 57

A vulnerability was found in Public CMS 5.202406.d and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0052 Published 2024-11-13 No fix listed CWE-79

Vulnerabilities

Filters