Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
56 results · page 1 of 2
Oct 13, 2026PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows autCVE-2026-110113 · Other software · Sanluan · reported by VulnCheckMedium 5.3
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A vulnerability was determined in PublicCMS up to 5.202608.a.CVE-2026-109160 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A weakness has been identified in Sanluan PublicCMS up to 6.202506.e.CVE-2026-97721 · Other software · Sanluan · reported by VulDBLow 2
A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java of the component exportExcel/exportData. This manipulation of the argument userId/deptId causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module.CVE-2026-36521 · Other software · reported by MITREMedium 6.1
PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 17, 2026A flaw has been found in Sanluan PublicCMS 5.202506.d.CVE-2026-8740 · Other software · Sanluan · reported by VulDBLow 2.1
A flaw has been found in Sanluan PublicCMS 5.202506.d. The impacted element is the function execute of the file publiccms-core/src/main/java/com/publiccms/views/directive/tools/TemplateResultDirective.java of the component templateResult API. This manipulation of the argument templateContent causes improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026A vulnerability was detected in Sanluan PublicCMS 5.202506.d.CVE-2026-8739 · Other software · Sanluan · reported by VulDBMedium 5.5
A vulnerability was detected in Sanluan PublicCMS 5.202506.d. The affected element is the function getSignKey of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java. The manipulation of the argument privatefile_key results in use of hard-coded cryptographic key . The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d.CVE-2026-8738 · Other software · Sanluan · reported by VulDBMedium 5.5
A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java of the component Trade Payment Flow. The manipulation leads to business logic errors. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026A weakness has been identified in Sanluan PublicCMS 5.202506.d.CVE-2026-8737 · Other software · Sanluan · reported by VulDBMedium 5.5
A weakness has been identified in Sanluan PublicCMS 5.202506.d. This issue affects the function execute of the file publiccms-trade/src/main/java/com/publiccms/views/directive/trade/TradeAddressListDirective.java of the component Trade Address Query Handler. Executing a manipulation of the argument userId/id can lead to missing authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026A vulnerability was identified in Sanluan PublicCMS up to 6.202506.d.CVE-2026-6797 · Other software · Sanluan · reported by VulDBMedium 5.3
A vulnerability was identified in Sanluan PublicCMS up to 6.202506.d. Affected by this vulnerability is the function ZipSecureFile.setMinflateRatio of the file common/src/main/java/com/publiccms/common/tools/DocToHtmlUtils.java. Such manipulation leads to resource consumption. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026A vulnerability was determined in Sanluan PublicCMS up to 6.202506.d.CVE-2026-6796 · Other software · Sanluan · reported by VulDBMedium 5.3
A vulnerability was determined in Sanluan PublicCMS up to 6.202506.d. Affected is the function log_login of the file core/src/main/java/com/publiccms/controller/admin/LoginAdminController.java of the component Failed Login Handler. This manipulation of the argument errorPassword causes cleartext storage in a file or on disk. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026A security vulnerability has been detected in Sanluan PublicCMS up to 6.202506.d.CVE-2026-5987 · Other software · Sanluan · reported by VulDBLow 2
A security vulnerability has been detected in Sanluan PublicCMS up to 6.202506.d. This affects the function AbstractFreemarkerView.doRender of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/common/base/AbstractFreemarkerView.java of the component FreeMarker Template Handler. Such manipulation leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026PublicCMS v5.202506.d and earlier is vulnerable to stored XSS.CVE-2025-69437 · Other software · Publiccms · reported by MITREHigh 8.7
PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can be triggered, resulting in issues such as credential theft, arbitrary API execution, and other security concerns. This vulnerability affects all file upload endpoint, including /cmsTemplate/save, /file/doUpload, /cmsTemplate/doUpload, /file/doBatchUpload, /cmsWebFile/doUpload, etc.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026A weakness has been identified in Sanluan PublicCMS 6.202506.d.CVE-2026-3289 · Other software · Sanluan · reported by VulDBLow 2.1
A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component Template Cache Generation. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d.CVE-2026-2010 · Other software · Sanluan · reported by VulDBLow 1.3
A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulation of the argument paymentId leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 7329437e1288540336b1c66c114ed3363adcba02. It is recommended to apply a patch to fix this issue.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2026A vulnerability was found in Sanluan PublicCMS up to 5.202506.d.CVE-2026-1112 · Other software · Sanluan · reported by VulDBLow 2.1
A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java of the component Trade Address Deletion Endpoint. Performing a manipulation of the argument ids results in improper authorization. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2026A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d.CVE-2026-1111 · Other software · Sanluan · reported by VulDBLow 2
A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2025PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.CVE-2025-65837 · Other software · Publiccms · reported by MITREMedium 5.4
PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.CVE-2025-65840 · Other software · Publiccms · reported by MITREHigh 8.8
PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.CVE-2025-65838 · Other software · Publiccms · reported by MITREHigh 7.5
PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025PublicCMS V5.202506.b is vulnerable to SSRF.CVE-2025-65836 · Other software · Publiccms · reported by MITRECritical 9.1
PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DACVE-2025-57516 · Other software · Publiccms · reported by MITREHigh 8.2
OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat file.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a.CVE-2025-7953 · Other software · Sanluan · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the file publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html. The manipulation of the argument File leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named f1af17af004ca9345c6fe4d5936d87d008d26e75. It is recommended to apply a patch to fix this issue.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A vulnerability was found in Sanluan PublicCMS up to 5.202506.a.CVE-2025-7949 · Other software · Sanluan · reported by VulDBLow 2
A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file publiccms-parent/publiccms/src/main/resources/templates/admin/cmsDiy/preview.html. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named c1e79f124e3f4c458315d908ed7dee06f9f12a76/f1af17af004ca9345c6fe4d5936d87d008d26e75. It is recommended to apply a patch to fix this issue.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code CVE-2025-25361 · Other software · Publiccms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d.CVE-2024-11070 · Other software · Sanluan · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment featureCVE-2024-46410 · Other software · publiccms · reported by MITREMedium 4.8
PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaDataCVE-2024-42523 · Other software · publiccms · reported by MITREHigh 7.2
publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
Jul 12, 2024PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java.CVE-2024-40552 · Other software · publiccms · reported by MITREHigh 8.8
PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via upCVE-2024-40551 · Other software · publiccms · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary CVE-2024-40550 · Other software · publiccms · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uCVE-2024-40549 · Other software · publiccms · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploadCVE-2024-40548 · Other software · publiccms · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace.CVE-2024-40547 · Other software · publiccms · reported by MITREMedium 6.5
PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploadiCVE-2024-40546 · Other software · publiccms · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uplCVE-2024-40545 · Other software · publiccms · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit.CVE-2024-40544 · Other software · publiccms · reported by MITREHigh 8.8
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage.CVE-2024-40543 · Other software · publiccms · reported by MITREHigh 8.8
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.CVE-2024-31759 · Other software · publiccms · reported by MITREHigh 8.8
An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.
- Product
- publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record1drv.msgist.github.com
Jan 10, 2024PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS).CVE-2023-51252 · Other software · Publiccms · reported by MITREMedium 5.4
PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace functiCVE-2023-46990 · Other software · Publiccms · reported by MITRECritical 9.8
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtmCVE-2023-48204 · Other software · Publiccms · reported by MITREMedium 6.5
An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.CVE-2023-34852 · Other software · Publiccms · reported by MITRECritical 9.8
PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSiteAdminControl.CVE-2020-20915 · Other software · Publiccms · reported by MITRECritical 9.8
SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSiteAdminControl.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.CVE-2020-20914 · Other software · Publiccms · reported by MITRECritical 9.8
SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022A vulnerability, which was classified as problematic, was found in sanluan PublicCMS.CVE-2022-3950 · Other software · sanluan · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.js of the component Tab Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a972dc9b1c94aea2d84478bf26283904c21e4ca2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213456.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.CVE-2021-27693 · Other software · Publiccms · reported by MITRECritical 9.8
Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2022PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java.CVE-2022-29784 · Other software · Publiccms · reported by MITREMedium 5.3
PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.CVE-2022-23389 · Other software · Publiccms · reported by MITRECritical 9.8
PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.CVE-2021-40881 · Other software · Publiccms · reported by MITRECritical 9.8
An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2021Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.CVE-2020-21333 · Other software · Publiccms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.