CVE-2025-69437 | High | 8.7 | 2026-02-27 | PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsF… |
CVE-2026-3289 | Medium | 6.3 | 2026-02-27 | A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component… |
CVE-2026-2010 | Medium | 4.2 | 2026-02-06 | A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/public… |
CVE-2026-1112 | Medium | 5.4 | 2026-01-18 | A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/contro… |
CVE-2026-1111 | Medium | 4.7 | 2026-01-18 | A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplat… |
CVE-2025-65837 | Medium | 5.4 | 2025-12-22 | PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module. |
CVE-2025-65840 | High | 8.8 | 2025-12-01 | PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController. |
CVE-2025-65838 | High | 7.5 | 2025-12-01 | PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method. |
CVE-2025-65836 | Critical | 9.1 | 2025-12-01 | PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController. |
CVE-2025-57516 | High | 8.2 | 2025-09-29 | OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted D… |
CVE-2025-7953 | Low | 3.5 | 2025-07-22 | A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the f… |
CVE-2025-7949 | Low | 3.5 | 2025-07-22 | A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-25361 | Critical | 9.8 | 2025-03-06 | An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code… |
CVE-2024-11175 | Low | 3.5 | 2024-11-13 | A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of… |
CVE-2024-11070 | Low | 3.5 | 2024-11-11 | A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /a… |
CVE-2024-46410 | Medium | 4.8 | 2024-10-08 | PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature |
CVE-2024-42523 | High | 7.2 | 2024-08-23 | publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData |
CVE-2024-40552 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java. |
CVE-2024-40551 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via u… |
CVE-2024-40550 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary… |
CVE-2024-40549 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via… |
CVE-2024-40548 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploa… |
CVE-2024-40547 | Medium | 6.5 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace. |
CVE-2024-40546 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via upload… |
CVE-2024-40545 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via up… |
CVE-2024-40544 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit. |
CVE-2024-40543 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage. |
CVE-2024-31759 | High | 8.8 | 2024-04-16 | An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function. |
CVE-2024-2911 | Medium | 4.3 | 2024-03-26 | A vulnerability, which was classified as problematic, was found in Tianjin PubliCMS 4.0.202302.e. This affects an unknown part. The manipulation leads to cross… |
CVE-2023-51252 | Medium | 5.4 | 2024-01-10 | PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files cont… |
CVE-2023-46990 | Critical | 9.8 | 2023-11-20 | Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace funct… |
CVE-2023-48204 | Medium | 6.5 | 2023-11-16 | An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHt… |
CVE-2023-34852 | Critical | 9.8 | 2023-06-15 | PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions. |
CVE-2020-20915 | Critical | 9.8 | 2023-04-04 | SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSiteAdminControl. |
CVE-2020-20914 | Critical | 9.8 | 2023-04-04 | SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter. |
CVE-2022-3950 | Low | 3.5 | 2022-11-11 | A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.js of the component… |
CVE-2021-27693 | Critical | 9.8 | 2022-09-02 | Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage. |
CVE-2022-29784 | Medium | 5.3 | 2022-06-03 | PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java. |
CVE-2022-23389 | Critical | 9.8 | 2022-02-14 | PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter. |
CVE-2021-40881 | Critical | 9.8 | 2021-09-15 | An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code. |
CVE-2020-21333 | Medium | 5.4 | 2021-07-09 | Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case. |
CVE-2018-18927 | Medium | 4.8 | 2018-11-04 | An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has 'class="icon-globe icon-large"' i… |
CVE-2018-17368 | Medium | 5.3 | 2018-09-23 | An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the username is valid, wh… |
CVE-2018-12914 | Critical | 9.8 | 2018-06-27 | A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traver… |
CVE-2018-12494 | Medium | 6.5 | 2018-06-15 | An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsTemplate/content.h… |
CVE-2018-12493 | Medium | 6.5 | 2018-06-15 | An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsWebFile/list.html?… |
CVE-2018-11500 | High | 8.8 | 2018-05-26 | An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" th… |