CVE-2026-30637 | High | 7.5 | 2026-03-27 | Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before. The vulnerability allows remote… |
CVE-2024-57252 | Medium | 4.3 | 2025-01-17 | OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily. |
CVE-2023-6772 | Medium | 4.7 | 2023-12-13 | A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulat… |
CVE-2023-3241 | Low | 3.5 | 2023-06-14 | A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?m… |
CVE-2023-3240 | Low | 3.5 | 2023-06-14 | A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersN… |
CVE-2023-3239 | Low | 3.5 | 2023-06-14 | A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQr… |
CVE-2023-3238 | Medium | 6.3 | 2023-06-14 | A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?m… |
CVE-2023-3237 | Medium | 6.3 | 2023-06-14 | A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/passwo… |
CVE-2023-1797 | Medium | 6.3 | 2023-04-02 | A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=s… |
CVE-2023-1635 | Low | 3.5 | 2023-03-25 | A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. Th… |
CVE-2023-1634 | Medium | 6.3 | 2023-03-25 | A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component… |
CVE-2019-17370 | High | 7.2 | 2019-10-09 | OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does not block the "into/*… |
CVE-2019-17369 | Medium | 6.5 | 2019-10-09 | OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin. |
CVE-2019-13971 | Medium | 6.1 | 2019-07-19 | OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request. |
CVE-2018-17364 | High | 8.1 | 2018-09-23 | OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter. |
CVE-2018-17086 | Medium | 6.1 | 2018-09-16 | An issue was discovered in OTCMS 3.61. XSS exists in admin/share_switch.php via these parameters: fieldName fieldName2 tabName. |
CVE-2018-17085 | Medium | 6.1 | 2018-09-16 | An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr. |
CVE-2018-8973 | Medium | 6.1 | 2018-03-24 | OTCMS 3.20 allows XSS by adding a keyword or link to an article, as demonstrated by an admin/keyWord_deal.php?mudi=add request. |