CVE-2025-3563 | Medium | 4.7 | 2025-04-14 | A vulnerability was found in WuzhiCMS 4.1. It has been rated as critical. Affected by this issue is the function Set of the file /index.php?m=attachment&f=inde… |
CVE-2025-25916 | Medium | 5.4 | 2025-02-28 | wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php. |
CVE-2025-0480 | Medium | 4.3 | 2025-01-15 | A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. T… |
CVE-2024-10505 | Medium | 6.3 | 2024-10-30 | A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/… |
CVE-2024-32206 | Medium | 4.6 | 2024-04-19 | A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web script… |
CVE-2024-31008 | Medium | 6.5 | 2024-04-03 | An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file. |
CVE-2023-52064 | Critical | 9.8 | 2024-01-10 | Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php. |
CVE-2023-46482 | Critical | 9.8 | 2023-11-01 | SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/d… |
CVE-2020-36037 | High | 8.8 | 2023-08-11 | An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php. |
CVE-2020-21325 | High | 8.8 | 2023-06-20 | An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file. |
CVE-2020-20413 | Critical | 9.8 | 2023-06-20 | SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php. |
CVE-2023-31860 | Medium | 5.4 | 2023-05-23 | Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system. |
CVE-2023-30123 | Medium | 5.4 | 2023-04-28 | wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings. |
CVE-2022-36168 | Low | 2.7 | 2022-08-26 | A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php: |
CVE-2020-19897 | Medium | 6.1 | 2022-06-28 | A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter. |
CVE-2021-41654 | Critical | 9.8 | 2022-06-16 | SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/p… |
CVE-2022-27431 | Critical | 9.8 | 2022-05-04 | Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php. |
CVE-2020-19770 | Medium | 5.4 | 2021-12-21 | A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie. |
CVE-2020-28145 | High | 7.5 | 2021-10-12 | Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensiti… |
CVE-2020-20124 | High | 8.8 | 2021-09-28 | Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php. |
CVE-2020-20122 | Critical | 9.8 | 2021-09-28 | Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php. |
CVE-2020-24930 | High | 8.1 | 2021-09-27 | Beijing Wuzhi Internet Technology Co., Ltd. Wuzhi CMS 4.0.1 is an open source content management system. The five fingers CMS backend in***.php file has arbitr… |
CVE-2020-19553 | Medium | 5.4 | 2021-09-21 | Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.cla… |
CVE-2020-19551 | High | 8.8 | 2021-09-21 | Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong. |
CVE-2020-19915 | Medium | 6.1 | 2021-09-20 | Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php. |
CVE-2021-40674 | Critical | 9.8 | 2021-09-20 | An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in coreframe/app/order/admin/index.php. |
CVE-2021-40670 | Critical | 9.8 | 2021-09-16 | SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file. |
CVE-2021-40669 | Critical | 9.8 | 2021-09-16 | SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file. |
CVE-2020-18877 | High | 7.5 | 2021-08-20 | SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin… |
CVE-2020-18654 | Medium | 6.1 | 2021-06-22 | Cross Site Scripting (XSS) in Wuzhi CMS v4.1.0 allows remote attackers to execute arbitrary code via the "Title" parameter in the component "/coreframe/app/gue… |
CVE-2020-21590 | Medium | 4.3 | 2021-04-02 | Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter. |
CVE-2018-17426 | Medium | 5.4 | 2019-03-07 | WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI. |
CVE-2018-17425 | Medium | 5.4 | 2019-03-07 | WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI. |
CVE-2019-9110 | Medium | 6.1 | 2019-02-25 | XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php. |
CVE-2019-9109 | Medium | 6.1 | 2019-02-25 | XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php. |
CVE-2019-9108 | Medium | 6.1 | 2019-02-25 | XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php. |
CVE-2019-9107 | Medium | 6.1 | 2019-02-25 | XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imagecut.php. |
CVE-2018-20572 | Critical | 9.8 | 2018-12-28 | WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue t… |
CVE-2018-18938 | Medium | 4.8 | 2018-11-05 | An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input fi… |
CVE-2018-18712 | High | 8.8 | 2018-10-29 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=e… |
CVE-2018-18711 | High | 8.8 | 2018-10-29 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edi… |
CVE-2018-17832 | Medium | 6.1 | 2018-10-01 | XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter. |
CVE-2018-14512 | Medium | 6.1 | 2018-07-23 | An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the for… |
CVE-2018-14472 | High | 7.2 | 2018-07-20 | An issue was discovered in WUZHI CMS 4.1.0. The vulnerable file is coreframe/app/order/admin/goods.php. The $keywords parameter is taken directly into executio… |
CVE-2018-11722 | Critical | 9.8 | 2018-06-05 | WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded. |
CVE-2018-11549 | Medium | 5.4 | 2018-05-29 | An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre -> Chinese information -> Ordinary member"… |
CVE-2018-11528 | Critical | 9.8 | 2018-05-29 | WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI. |
CVE-2018-11493 | High | 8.8 | 2018-05-26 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add. |
CVE-2018-10391 | Medium | 4.8 | 2018-04-26 | An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI. |
CVE-2018-10368 | Medium | 4.8 | 2018-04-25 | An issue was discovered in WUZHI CMS 4.1.0. The "Extension Module -> System Announcement" feature has Stored XSS via an announcement. |
CVE-2018-10367 | Medium | 4.8 | 2018-04-25 | An issue was discovered in WUZHI CMS 4.1.0. The content-management feature has Stored XSS via the title or content section. |
CVE-2018-10313 | Medium | 5.4 | 2018-04-24 | WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set_iframe=1 URI. |
CVE-2018-10312 | High | 8.8 | 2018-04-24 | index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member. |
CVE-2018-10311 | Medium | 6.1 | 2018-04-24 | A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tag[piny… |
CVE-2018-10248 | Medium | 6.5 | 2018-04-20 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycle_delete. |
CVE-2018-10221 | Medium | 5.4 | 2018-04-19 | An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tag[tag] parameter to the… |
CVE-2018-9927 | High | 8.8 | 2018-04-10 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add. |
CVE-2018-9926 | High | 8.8 | 2018-04-10 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add. |