Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: Ulicms Clear all filters
TI-2023-30208 CVE-2023-53925 · GHSA-w6g7-5cg4-mww6

UliCMS 2023.1 Stored Cross-Site Scripting via SVG File Upload

Priority MEDIUM 56

UliCMS 2023.1 contains a stored cross-site scripting vulnerability that allows attackers to upload malicious SVG files with embedded JavaScript.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00371 Published 2025-12-17 No fix listed CWE-79
TI-2023-30207 CVE-2023-53924 · GHSA-xrjv-cxq7-2pw3

UliCMS 2023.1-sniffing-vicuna Remote Code Execution via Avatar Upload

Priority HIGH 73

UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar upload.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00944 Published 2025-12-17 No fix listed CWE-434
TI-2023-30197 CVE-2023-53914 · GHSA-7ff4-756p-256w

UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability

Priority HIGH 81

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00686 Published 2025-12-17 No fix listed CWE-639