Vulnerabilities

TI-2025-19246 CVE-2025-26136 · GHSA-5fqj-hrv8-fhp4

A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1.

MEDIUM 49

A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00397 Published 2025-03-04 No fix listed CWE-89

TI-2024-38058 CVE-2024-57767 · GHSA-gw98-8mff-5x24

MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.

HIGH 76

MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00445 Published 2025-01-14 No fix listed CWE-918

TI-2024-38057 CVE-2024-57766 · GHSA-h6h5-h6hh-wcrw

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability…

MEDIUM 48

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00519 Published 2025-01-14 No fix listed CWE-502

TI-2024-38056 CVE-2024-57765 · GHSA-vghf-7644-rgvm

MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list.

HIGH 74

MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00455 Published 2025-01-14 No fix listed CWE-89

TI-2024-38055 CVE-2024-57764 · GHSA-q5hp-hpff-j44c

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability…

HIGH 80

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00519 Published 2025-01-14 No fix listed CWE-502

TI-2024-38054 CVE-2024-57763 · GHSA-f765-52vq-524g

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability…

HIGH 80

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00519 Published 2025-01-14 No fix listed CWE-502

TI-2024-38053 CVE-2024-57762 · GHSA-2977-6mrh-4c63

MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.

HIGH 74

MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00519 Published 2025-01-14 No fix listed CWE-502

TI-2024-12186 CVE-2024-13139 · GHSA-7whx-v52v-gg25

wangl1989 mysiteforme FileController doContent server-side request forgery

MEDIUM 57

A vulnerability was found in wangl1989 mysiteforme 1.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00585 Published 2025-01-05 No fix listed CWE-918

TI-2024-12185 CVE-2024-13138 · GHSA-wq4v-g552-cgfg

wangl1989 mysiteforme LocalUploadServiceImpl upload unrestricted upload

MEDIUM 56

A vulnerability was found in wangl1989 mysiteforme 1.0.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.0046 Published 2025-01-05 No fix listed CWE-284

TI-2024-12184 CVE-2024-13137 · GHSA-vr63-2695-ppff

wangl1989 mysiteforme SiteController RestResponse cross site scripting

MEDIUM 56

A vulnerability was found in wangl1989 mysiteforme 1.0.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00346 Published 2025-01-05 No fix listed CWE-79

TI-2024-12183 CVE-2024-13136 · GHSA-9v62-r8m2-76m8

wangl1989 mysiteforme ShiroConfig.java rememberMeManager deserialization

MEDIUM 57

A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00633 Published 2025-01-05 No fix listed CWE-20

TI-2022-11826 CVE-2022-29309 · GHSA-gpvf-c684-3rmh

mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery.

LOW 35

mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00924 Published 2022-05-24 No fix listed CWE-918

TI-2021-21006 CVE-2021-46026 · GHSA-wcp3-6gpr-378g

mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add…

LOW 25

mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog tag in the background blog management.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00441 Published 2022-01-19 No fix listed CWE-79

TI-2021-21007 CVE-2021-46027 · GHSA-76hq-7c4p-7vcg

mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management.

LOW 29

mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00416 Published 2022-01-19 No fix listed CWE-352

Vulnerabilities

Filters