CVE-2026-2954 | Medium | 6.3 | 2026-02-22 | A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the compone… |
CVE-2026-2953 | Medium | 5.4 | 2026-02-22 | A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the comp… |
CVE-2025-2491 | Low | 2.4 | 2025-03-18 | A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/… |
CVE-2025-2490 | Low | 2.4 | 2025-03-18 | A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/j… |
CVE-2025-25772 | Medium | 5.1 | 2025-02-21 | A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accoun… |
CVE-2024-55452 | Medium | 5.4 | 2024-12-16 | A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulner… |
CVE-2024-55451 | Medium | 4.8 | 2024-12-16 | A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises fr… |
CVE-2024-12483 | Low | 3.7 | 2024-12-12 | A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User… |
CVE-2024-1257 | Low | 3.5 | 2024-02-06 | A vulnerability was found in Jspxcms 10.2.0. It has been classified as problematic. Affected is an unknown function of the file /ext/collect/find_text.do. The… |
CVE-2024-1256 | Low | 3.5 | 2024-02-06 | A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. This issue affects some unknown processing of the file /ext/collect/filter_text.do… |
CVE-2024-0599 | Low | 3.5 | 2024-01-16 | A vulnerability was found in Jspxcms 10.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file src\ma… |
CVE-2023-51806 | Medium | 5.4 | 2024-01-12 | File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file. |
CVE-2023-51350 | Critical | 9.8 | 2024-01-11 | A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-… |
CVE-2023-34878 | High | 7.5 | 2023-06-14 | An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip. |
CVE-2023-34865 | Critical | 9.8 | 2023-06-14 | Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature. |
CVE-2023-34747 | Critical | 9.8 | 2023-06-14 | File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload. |
CVE-2023-3231 | Low | 3.1 | 2023-06-14 | A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler… |
CVE-2023-24369 | Medium | 6.1 | 2023-02-17 | A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the U… |
CVE-2022-28090 | Medium | 6.5 | 2022-05-04 | Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=. |
CVE-2022-23329 | Critical | 9.8 | 2022-02-04 | A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading maliciou… |