Publiccms
by Publiccms
Source repositories
CVEs (48)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-31759 | Hig | 0.57 | 8.8 | 0.01 | Apr 16, 2024 | An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function. | ||
| CVE-2018-11500 | Hig | 0.57 | 8.8 | 0.01 | May 26, 2018 | An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account. | ||
| CVE-2025-57516 | Hig | 0.53 | 8.2 | 0.01 | Sep 29, 2025 | OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat file. | ||
| CVE-2025-65838 | Hig | 0.49 | 7.5 | 0.00 | Dec 1, 2025 | PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method. | ||
| CVE-2024-42523 | Hig | 0.47 | 7.2 | 0.01 | Aug 23, 2024 | publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData | ||
| CVE-2026-8738 | Med | 0.42 | 6.5 | 0.00 | May 17, 2026 | A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.j… | ||
| CVE-2024-40547 | Med | 0.42 | 6.5 | 0.00 | Jul 12, 2024 | PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace. | ||
| CVE-2023-48204 | Med | 0.42 | 6.5 | 0.01 | Nov 16, 2023 | An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component. | ||
| CVE-2018-12494 | Med | 0.42 | 6.5 | 0.02 | Jun 15, 2018 | An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsTemplate/content.html?path=../ URI. | ||
| CVE-2018-12493 | Med | 0.42 | 6.5 | 0.02 | Jun 15, 2018 | An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsWebFile/list.html?path=../ URI. | ||
| CVE-2026-3289 | Med | 0.41 | 6.3 | 0.01 | Feb 27, 2026 | A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component Template Cache Generation. Executing a manipulation can lead to path traversal. The attack can be executed remotely.… | ||
| CVE-2026-1112 | Med | 0.35 | 5.4 | 0.00 | Jan 18, 2026 | A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java of the component Trade Address Deletion Endpoint. Performing a manipulation… | ||
| CVE-2025-65837 | Med | 0.35 | 5.4 | 0.00 | Dec 22, 2025 | PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module. | ||
| CVE-2023-51252 | Med | 0.35 | 5.4 | 0.00 | Jan 10, 2024 | PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing. | ||
| CVE-2020-21333 | Med | 0.35 | 5.4 | 0.00 | Jul 9, 2021 | Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case. | ||
| CVE-2018-17368 | Med | 0.35 | 5.3 | 0.01 | Sep 23, 2018 | An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the username is valid, which makes it easier to conduct brute-force attacks. | ||
| CVE-2026-1111 | Med | 0.31 | 4.7 | 0.01 | Jan 18, 2026 | A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to… | ||
| CVE-2024-46410 | Med | 0.31 | 4.8 | 0.00 | Oct 8, 2024 | PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature | ||
| CVE-2018-18927 | Med | 0.31 | 4.8 | 0.01 | Nov 4, 2018 | An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has 'class="icon-globe icon-large"' in its value), as demonstrated by an 'UPDATE sys_module SET attached = "[XSS]" WHERE id="page_list"' statement. | ||
| CVE-2024-2911 | Med | 0.28 | 4.3 | 0.00 | Mar 26, 2024 | A vulnerability, which was classified as problematic, was found in Tianjin PubliCMS 4.0.202302.e. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and… |
- risk 0.57cvss 8.8epss 0.01
An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account.
- risk 0.53cvss 8.2epss 0.01
OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat file.
- risk 0.49cvss 7.5epss 0.00
PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.
- risk 0.47cvss 7.2epss 0.01
publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData
- risk 0.42cvss 6.5epss 0.00
A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.j…
- risk 0.42cvss 6.5epss 0.00
PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace.
- risk 0.42cvss 6.5epss 0.01
An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component.
- risk 0.42cvss 6.5epss 0.02
An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsTemplate/content.html?path=../ URI.
- risk 0.42cvss 6.5epss 0.02
An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsWebFile/list.html?path=../ URI.
- risk 0.41cvss 6.3epss 0.01
A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component Template Cache Generation. Executing a manipulation can lead to path traversal. The attack can be executed remotely.…
- risk 0.35cvss 5.4epss 0.00
A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java of the component Trade Address Deletion Endpoint. Performing a manipulation…
- risk 0.35cvss 5.4epss 0.00
PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.
- risk 0.35cvss 5.4epss 0.00
PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing.
- risk 0.35cvss 5.4epss 0.00
Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.
- risk 0.35cvss 5.3epss 0.01
An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the username is valid, which makes it easier to conduct brute-force attacks.
- risk 0.31cvss 4.7epss 0.01
A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to…
- risk 0.31cvss 4.8epss 0.00
PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has 'class="icon-globe icon-large"' in its value), as demonstrated by an 'UPDATE sys_module SET attached = "[XSS]" WHERE id="page_list"' statement.
- risk 0.28cvss 4.3epss 0.00
A vulnerability, which was classified as problematic, was found in Tianjin PubliCMS 4.0.202302.e. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and…
Page 2 of 3