CVE-2024-12348 | Low | 3.5 | 2024-12-09 | A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2. It has been classified as problematic. Affected is the function AttachmentUtils.isUnSafe o… |
CVE-2024-11971 | Low | 3.5 | 2024-11-28 | A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-50919 | Critical | 9.8 | 2024-11-18 | Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary c… |
CVE-2024-46468 | High | 7.5 | 2024-10-11 | A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitive information, resul… |
CVE-2024-8304 | Medium | 4.7 | 2024-08-29 | A vulnerability has been found in jpress up to 5.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/… |
CVE-2024-43033 | High | 8.8 | 2024-08-22 | JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such… |
CVE-2024-32358 | High | 7.5 | 2024-04-25 | An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerabi… |
CVE-2022-23330 | High | 8.8 | 2022-02-04 | A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR pac… |
CVE-2021-46114 | High | 8.8 | 2022-01-26 | jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can… |
CVE-2021-46118 | High | 7.2 | 2022-01-26 | jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. The admin panel provides a function through… |
CVE-2021-46116 | High | 7.2 | 2022-01-26 | jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall. The admin panel provides a function through which at… |
CVE-2021-46115 | High | 7.2 | 2022-01-26 | jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The admin panel provides a function through which attackers can upl… |
CVE-2021-46117 | High | 7.2 | 2022-01-26 | jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. The admin panel provides a function through which atta… |
CVE-2021-45808 | High | 8.8 | 2022-01-19 | jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server. |
CVE-2021-45807 | Critical | 9.8 | 2022-01-13 | jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall. |
CVE-2021-45806 | High | 8.8 | 2022-01-13 | jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code. |
CVE-2021-33347 | Medium | 5.4 | 2021-06-18 | An issue was discovered in JPress v3.3.0 and below. There are XSS vulnerabilities in the template module and tag management module. If you log in to the backgr… |
CVE-2019-6278 | Medium | 5.4 | 2019-01-14 | XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option. |
CVE-2018-19170 | Medium | 4.8 | 2018-11-11 | In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name… |