Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
108 results · page 2 of 3
Nov 23, 2022Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.CVE-2022-45278 · Other software · Jizhicms · reported by MITREHigh 8.8
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.CVE-2022-44140 · Other software · Jizhicms · reported by MITREHigh 8.8
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022An issue was discovered in JIZHI CMS 1.9.4.CVE-2021-29334 · Other software · Jizhicms · reported by MITREHigh 8.8
An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Aug 25, 2022A directory traversal vulnerability was discovered in Wuzhicms 4.1.0.CVE-2022-36168 · Other software · Wuzhicms · reported by MITRELow 2.7
A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php:
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022jizhicms v2.3.1 has SQL injection in the background.CVE-2022-36578 · Other software · Jizhicms · reported by MITRECritical 9.8
jizhicms v2.3.1 has SQL injection in the background.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022An issue was discovered in jizhicms v2.3.1.CVE-2022-36577 · Other software · Jizhicms · reported by MITREHigh 8.8
An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter.CVE-2020-19897 · Other software · Wuzhicms · reported by MITREMedium 6.1
A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/paCVE-2021-41654 · Other software · Wuzhicms · reported by MITRECritical 9.8
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.CVE-2022-31393 · Other software · Jizhicms · reported by MITRECritical 9.1
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.CVE-2022-31390 · Other software · Jizhicms · reported by MITRECritical 9.1
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.CVE-2022-27431 · Other software · Wuzhicms · reported by MITRECritical 9.8
Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.CVE-2022-27429 · Other software · Jizhicms · reported by MITRECritical 9.8
Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie.CVE-2020-19770 · Other software · Wuzhicms · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2021Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitivCVE-2020-28145 · Other software · Wuzhicms · reported by MITREHigh 7.5
Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2021JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administratCVE-2020-21228 · Other software · Jizhicms · reported by MITREMedium 6.1
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.CVE-2020-20124 · Other software · Wuzhicms · reported by MITREHigh 8.8
Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Sep 28, 2021Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php.CVE-2020-20122 · Other software · Wuzhicms · reported by MITRECritical 9.8
Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2021Beijing Wuzhi Internet Technology Co., Ltd.CVE-2020-24930 · Other software · Wuzhicms · reported by MITREHigh 8.1
Beijing Wuzhi Internet Technology Co., Ltd. Wuzhi CMS 4.0.1 is an open source content management system. The five fingers CMS backend in***.php file has arbitrary file deletion vulnerability. Attackers can use vulnerabilities to delete arbitrary files.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2021Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.clasCVE-2020-19553 · Other software · Wuzhicms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.class.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2021Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong.CVE-2020-19551 · Other software · Wuzhicms · reported by MITREHigh 8.8
Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php.CVE-2020-19915 · Other software · Wuzhicms · reported by MITREMedium 6.1
Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 20, 2021An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in coreframe/app/order/admin/index.php.CVE-2021-40674 · Other software · Wuzhicms · reported by MITRECritical 9.8
An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in coreframe/app/order/admin/index.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2021SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file.CVE-2021-40670 · Other software · Wuzhicms · reported by MITRECritical 9.8
SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2021SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file.CVE-2021-40669 · Other software · Wuzhicms · reported by MITRECritical 9.8
SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later changed to a PHP file.CVE-2020-21483 · Other software · Jizhicms · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later changed to a PHP file.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordporlockz.comporlockz.com
Aug 20, 2021SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin/CVE-2020-18877 · Other software · Wuzhicms · reported by MITREHigh 7.5
SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin/index.php'.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2021Cross Site Scripting (XSS) in Wuzhi CMS v4.1.0 allows remote attackers to execute arbitrary code via the "Title" parameter in the component "/coreframe/app/guesCVE-2020-18654 · Other software · Wuzhicms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Wuzhi CMS v4.1.0 allows remote attackers to execute arbitrary code via the "Title" parameter in the component "/coreframe/app/guestbook/myissue.php".
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter.CVE-2020-21590 · Other software · Wuzhicms · reported by MITREMedium 4.3
Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2021XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.CVE-2020-23644 · Other software · Jizhicms · reported by MITREMedium 6.1
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2021XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php.CVE-2020-23643 · Other software · Jizhicms · reported by MITREMedium 6.1
XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2019JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.CVE-2019-17593 · Other software · Jizhicms · reported by MITREHigh 8.8
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI.CVE-2018-17426 · Other software · Wuzhicms · reported by MITREMedium 5.4
WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.CVE-2018-17425 · Other software · Wuzhicms · reported by MITREMedium 5.4
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2019XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php.CVE-2019-9110 · Other software · Wuzhicms · reported by MITREMedium 6.1
XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 24, 2019XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php.CVE-2019-9109 · Other software · Wuzhicms · reported by MITREMedium 6.1
XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 24, 2019XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php.CVE-2019-9108 · Other software · Wuzhicms · reported by MITREMedium 6.1
XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 24, 2019XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imagecut.php.CVE-2019-9107 · Other software · Wuzhicms · reported by MITREMedium 6.1
XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imagecut.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 28, 2018WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue toCVE-2018-20572 · Other software · Wuzhicms · reported by MITRECritical 9.8
WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-18938 · Other software · Wuzhicms · reported by MITREMedium 4.8
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-18712 · Other software · Wuzhicms · reported by MITREHigh 8.8
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-18711 · Other software · Wuzhicms · reported by MITREHigh 8.8
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edit_info.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2018XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter.CVE-2018-17832 · Other software · Wuzhicms · reported by MITREMedium 6.1
XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter.
- Product
- Wuzhi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexploit-db.com
Jul 23, 2018An XSS vulnerability was discovered in WUZHI CMS 4.1.0.CVE-2018-14512 · Other software · Wuzhicms · reported by MITREMedium 6.1
An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[nickname] parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server" screen, the XSS payload is triggered.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-14472 · Other software · Wuzhicms · reported by MITREHigh 7.2
An issue was discovered in WUZHI CMS 4.1.0. The vulnerable file is coreframe/app/order/admin/goods.php. The $keywords parameter is taken directly into execution without any filtering, leading to SQL injection.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2018WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.CVE-2018-11722 · Other software · Wuzhicms · reported by MITRECritical 9.8
WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2018An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre -> Chinese information -> Ordinary member" CVE-2018-11549 · Other software · Wuzhicms · reported by MITREMedium 5.4
An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre -> Chinese information -> Ordinary member" via a QQ number, as demonstrated by a form[qq_10]= substring.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2018WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.CVE-2018-11528 · Other software · Wuzhicms · reported by MITRECritical 9.8
WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-11493 · Other software · Wuzhicms · reported by MITREHigh 8.8
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-10391 · Other software · Wuzhicms · reported by MITREMedium 4.8
An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-10368 · Other software · Wuzhicms · reported by MITREMedium 4.8
An issue was discovered in WUZHI CMS 4.1.0. The "Extension Module -> System Announcement" feature has Stored XSS via an announcement.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.