CVE-2025-50229 | Critical | 9.8 | 2026-04-23 | Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module. |
CVE-2025-50228 | Critical | 9.1 | 2026-04-09 | Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules. |
CVE-2026-29840 | Medium | 5.4 | 2026-03-24 | JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserController.php. The applica… |
CVE-2026-3292 | Medium | 6.3 | 2026-02-27 | A security vulnerability has been detected in jizhiCMS up to 2.5.6. Affected is the function findAll in the library frphp/lib/Model.php of the component Batch… |
CVE-2025-70397 | High | 7.2 | 2026-02-17 | jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter. |
CVE-2020-37117 | High | 8.8 | 2026-02-05 | jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files… |
CVE-2025-14013 | Low | 2.4 | 2025-12-04 | A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.php/admins/Comment/addcomment.html of th… |
CVE-2025-14012 | Medium | 4.7 | 2025-12-04 | A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of the file /index.php/admins/Comment/del… |
CVE-2025-14011 | Medium | 4.7 | 2025-12-04 | A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Comment/addcomment.html of the component… |
CVE-2025-2639 | Medium | 4.3 | 2025-03-23 | A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic. This vulnerability affects unknown code of the file /user/release.html of… |
CVE-2025-2638 | Medium | 4.3 | 2025-03-23 | A vulnerability, which was classified as problematic, was found in JIZHICMS up to 1.7.0. This affects an unknown part of the file /user/release.html of the com… |
CVE-2025-2637 | Medium | 4.3 | 2025-03-23 | A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file… |
CVE-2025-25785 | Critical | 9.1 | 2025-02-26 | JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers… |
CVE-2025-25784 | Critical | 9.8 | 2025-02-26 | An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a… |
CVE-2024-34255 | Medium | 6.1 | 2024-05-08 | jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function. |
CVE-2024-33338 | High | 7.3 | 2024-04-29 | Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request. |
CVE-2024-32161 | Critical | 9.8 | 2024-04-17 | jizhiCMS 2.5 suffers from a File upload vulnerability. |
CVE-2023-51154 | Critical | 9.8 | 2024-01-04 | Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php. |
CVE-2023-50692 | High | 8.8 | 2023-12-28 | File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url pa… |
CVE-2023-43836 | Medium | 6.5 | 2023-10-02 | There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information |
CVE-2023-38948 | High | 7.2 | 2023-08-03 | An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloadin… |
CVE-2023-2927 | Medium | 6.3 | 2023-05-27 | A vulnerability was found in JIZHICMS 2.4.5. It has been classified as critical. Affected is the function index of the file TemplateController.php. The manipul… |
CVE-2023-31862 | Medium | 5.4 | 2023-05-19 | jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published in the front end is only filtered in the front end, without b… |
CVE-2023-27235 | High | 7.2 | 2023-03-15 | An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a craft… |
CVE-2023-27234 | Medium | 6.5 | 2023-03-15 | A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application. |
CVE-2021-36484 | Critical | 9.8 | 2023-02-03 | SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page. |
CVE-2022-45278 | High | 8.8 | 2022-11-23 | Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component. |
CVE-2022-44140 | High | 8.8 | 2022-11-23 | Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component. |
CVE-2021-29334 | High | 8.8 | 2022-11-23 | An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html |
CVE-2022-36578 | Critical | 9.8 | 2022-08-19 | jizhicms v2.3.1 has SQL injection in the background. |
CVE-2022-36577 | High | 8.8 | 2022-08-19 | An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin. |
CVE-2022-31393 | Critical | 9.1 | 2022-06-09 | Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php. |
CVE-2022-31390 | Critical | 9.1 | 2022-06-09 | Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php. |
CVE-2022-27429 | Critical | 9.8 | 2022-04-25 | Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html. |
CVE-2020-21228 | Medium | 6.1 | 2021-10-01 | JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administra… |
CVE-2020-21483 | High | 7.2 | 2021-09-15 | An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later changed to a PHP file. |
CVE-2020-23644 | Medium | 6.1 | 2021-01-11 | XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php. |
CVE-2020-23643 | Medium | 6.1 | 2021-01-11 | XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php. |
CVE-2019-17593 | High | 8.8 | 2019-10-14 | JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator. |