Vulnerabilities

TI-2022-23273 CVE-2022-46999 · GHSA-v9qx-cmx2-x3pw

Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component…

HIGH 82

Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00967 Published 2023-01-25 No fix listed CWE-89

TI-2022-07874 CVE-2022-23882 · GHSA-qfjq-95hq-267q

MEDIUM 44

TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0108 Published 2022-03-28 No fix listed CWE-89

TI-2019-12455 CVE-2019-16657 · GHSA-2q8j-pc54-hhg5

LOW 29

TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00749 Published 2019-09-21 No fix listed CWE-79

TI-2019-12456 CVE-2019-16658 · GHSA-4ww6-v8j9-4cf3

LOW 39

TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00547 Published 2019-09-21 No fix listed CWE-352

TI-2019-12457 CVE-2019-16659 · GHSA-grpp-w2p8-7xj5

LOW 39

TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00547 Published 2019-09-21 No fix listed CWE-352

TI-2019-12445 CVE-2019-16644 · GHSA-vp95-g6wq-8mjp

MEDIUM 45

App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01366 Published 2019-09-20 No fix listed CWE-89

TI-2018-07218 CVE-2018-10185 · GHSA-qmmp-gc5q-cq8j

LOW 39

An issue was discovered in TuziCMS v2.0.6.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00505 Published 2018-04-17 No fix listed CWE-352