Vulnerabilities

Filters

Reset all

1 selected

58 records

Sort

Vendor: Wuzhicms Clear all filters

TI-2025-03132 CVE-2025-3563 · GHSA-7p3g-jgfx-frjh

WuzhiCMS Setting index.php set code injection

MEDIUM 56

A vulnerability was found in WuzhiCMS 4.1.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00712 Published 2025-04-14 No fix listed CWE-74

TI-2025-19180 CVE-2025-25916 · GHSA-pqmh-jm9r-hq9j

wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.

MEDIUM 58

wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00236 Published 2025-02-28 No fix listed CWE-79

TI-2025-00397 CVE-2025-0480 · GHSA-4rhc-q92g-rm98

wuzhicms config.php test server-side request forgery

LOW 25

A vulnerability classified as problematic has been found in wuzhicms 4.1.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0051 Published 2025-01-15 No fix listed CWE-918

TI-2024-09731 CVE-2024-10505 · GHSA-2ggq-hfx2-5mqh

wuzhicms block.php edit code injection

MEDIUM 57

A vulnerability was found in wuzhicms 4.1.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00713 Published 2024-10-30 No fix listed CWE-94

TI-2024-21232 CVE-2024-32206 · GHSA-26cp-j6f9-2w7c

A stored cross-site scripting (XSS) vulnerability in the component…

MEDIUM 54

A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $formdata p…

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00392 Published 2024-04-19 No fix listed CWE-79

TI-2024-20435 CVE-2024-31008 · GHSA-wjf7-jjrj-rw8w

An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute…

MEDIUM 62

An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00673 Published 2024-04-03 No fix listed CWE-290

TI-2023-28511 CVE-2023-52064 · GHSA-wcp2-36p3-v9xg

Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords…

HIGH 82

Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0064 Published 2024-01-10 No fix listed CWE-89

TI-2023-25027 CVE-2023-46482 · GHSA-hw7v-x4gj-9m6p

SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute…

MEDIUM 52

SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/database/admin/index.php component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01415 Published 2023-11-01 No fix listed CWE-89

TI-2020-18426 CVE-2020-36037 · GHSA-658x-hxq7-f72p

An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte…

HIGH 73

An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01046 Published 2023-08-11 No fix listed

TI-2020-14029 CVE-2020-21325 · GHSA-cxpq-h2qw-mwp5

An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the…

HIGH 73

An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01263 Published 2023-06-20 No fix listed CWE-434

TI-2020-13844 CVE-2020-20413 · GHSA-x56c-grq3-w2x8

SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute…

HIGH 82

SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01343 Published 2023-06-20 No fix listed CWE-89

TI-2023-15245 CVE-2023-31860 · GHSA-q3wv-mx62-wh2m

Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.

MEDIUM 58

Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00384 Published 2023-05-23 No fix listed CWE-79

TI-2023-14141 CVE-2023-30123 · GHSA-v9x8-qh99-p2rf

wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.

MEDIUM 58

wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00394 Published 2023-04-28 No fix listed CWE-79

TI-2022-16576 CVE-2022-36168 · GHSA-rjwx-467q-qhmr

A directory traversal vulnerability was discovered in Wuzhicms 4.1.0.

LOW 16

A directory traversal vulnerability was discovered in Wuzhicms 4.1.0.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00977 Published 2022-08-25 No fix listed CWE-22

TI-2020-13736 CVE-2020-19897 · GHSA-h75j-v2w7-p365

A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to…

LOW 29

A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00774 Published 2022-06-28 No fix listed CWE-79

TI-2021-18358 CVE-2021-41654 · GHSA-63w8-jhm5-x9vp

SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute…

MEDIUM 44

SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0108 Published 2022-06-16 No fix listed CWE-89

TI-2022-10461 CVE-2022-27431 · GHSA-7cvg-hmpm-m53g

Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid…

MEDIUM 44

Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0108 Published 2022-05-04 No fix listed CWE-89

TI-2020-13705 CVE-2020-19770 · GHSA-2hwq-fmxr-9p5h

A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS…

LOW 25

A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00503 Published 2021-12-21 No fix listed CWE-79

TI-2020-17112 CVE-2020-28145 · GHSA-23cg-4fwx-fhrv

Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via…

LOW 35

Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01254 Published 2021-10-12 No fix listed CWE-668

TI-2020-13767 CVE-2020-20124 · GHSA-99g3-m7v3-fpm5

Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.

MEDIUM 43

Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02858 Published 2021-09-28 No fix listed CWE-94

TI-2020-13766 CVE-2020-20122 · GHSA-xwp4-q27f-4wwf

Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in…

MEDIUM 45

Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0128 Published 2021-09-28 No fix listed CWE-89

TI-2020-15247 CVE-2020-24930 · GHSA-7rfv-8m4r-pfpg

Beijing Wuzhi Internet Technology Co., Ltd.

LOW 37

Beijing Wuzhi Internet Technology Co., Ltd.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01128 Published 2021-09-27 No fix listed

TI-2020-13644 CVE-2020-19553 · GHSA-4wjj-h3rw-qhx4

Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in…

LOW 25

Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.class.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00581 Published 2021-09-21 No fix listed CWE-79

TI-2020-13643 CVE-2020-19551 · GHSA-h2qh-93xp-94xr

Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php…

MEDIUM 42

Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0176 Published 2021-09-21 No fix listed CWE-863

TI-2020-13741 CVE-2020-19915 · GHSA-h746-v282-j5wj

Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php.

LOW 29

Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00801 Published 2021-09-20 No fix listed CWE-79