Jizhicms
Products
1- 40 CVEs
Recent CVEs
40| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-50229 | Cri | 0.64 | 9.8 | 0.00 | Apr 23, 2026 | Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module. | ||
| CVE-2025-25784 | Cri | 0.64 | 9.8 | 0.01 | Feb 26, 2025 | An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file. | ||
| CVE-2024-32161 | Cri | 0.64 | 9.8 | 0.01 | Apr 17, 2024 | jizhiCMS 2.5 suffers from a File upload vulnerability. | ||
| CVE-2023-51154 | Cri | 0.64 | 9.8 | 0.01 | Jan 4, 2024 | Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php. | ||
| CVE-2021-36484 | Cri | 0.64 | 9.8 | 0.01 | Feb 3, 2023 | SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page. | ||
| CVE-2022-36578 | Cri | 0.64 | 9.8 | 0.01 | Aug 19, 2022 | jizhicms v2.3.1 has SQL injection in the background. | ||
| CVE-2022-27429 | Cri | 0.64 | 9.8 | 0.01 | Apr 25, 2022 | Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html. | ||
| CVE-2025-25785 | Cri | 0.59 | 9.1 | 0.00 | Feb 26, 2025 | JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request. | ||
| CVE-2022-31393 | Cri | 0.59 | 9.1 | 0.01 | Jun 9, 2022 | Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php. | ||
| CVE-2022-31390 | Cri | 0.59 | 9.1 | 0.01 | Jun 9, 2022 | Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php. | ||
| CVE-2020-37117 | Hig | 0.57 | 8.8 | 0.01 | Feb 5, 2026 | jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files. Attackers can exploit the vulnerability by sending crafted POST requests with malicious filepath and download_url… | ||
| CVE-2023-50692 | Hig | 0.57 | 8.8 | 0.01 | Dec 28, 2023 | File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory. | ||
| CVE-2022-45278 | Hig | 0.57 | 8.8 | 0.01 | Nov 23, 2022 | Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component. | ||
| CVE-2022-44140 | Hig | 0.57 | 8.8 | 0.01 | Nov 23, 2022 | Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component. | ||
| CVE-2021-29334 | Hig | 0.57 | 8.8 | 0.00 | Nov 23, 2022 | An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html | ||
| CVE-2022-36577 | Hig | 0.57 | 8.8 | 0.00 | Aug 19, 2022 | An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin. | ||
| CVE-2019-17593 | Hig | 0.57 | 8.8 | 0.00 | Oct 14, 2019 | JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator. | ||
| CVE-2025-50228 | Cri | 0.52 | 9.1 | 0.00 | Apr 9, 2026 | Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules. | ||
| CVE-2024-33338 | Hig | 0.48 | 7.3 | 0.01 | Apr 29, 2024 | Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request. | ||
| CVE-2025-70397 | Hig | 0.47 | 7.2 | 0.00 | Feb 17, 2026 | jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter. |
- risk 0.64cvss 9.8epss 0.00
Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.
- risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.
- risk 0.64cvss 9.8epss 0.01
jizhiCMS 2.5 suffers from a File upload vulnerability.
- risk 0.64cvss 9.8epss 0.01
Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.
- risk 0.64cvss 9.8epss 0.01
SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.
- risk 0.64cvss 9.8epss 0.01
jizhicms v2.3.1 has SQL injection in the background.
- risk 0.64cvss 9.8epss 0.01
Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.
- risk 0.59cvss 9.1epss 0.00
JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request.
- risk 0.59cvss 9.1epss 0.01
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.
- risk 0.59cvss 9.1epss 0.01
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.
- risk 0.57cvss 8.8epss 0.01
jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files. Attackers can exploit the vulnerability by sending crafted POST requests with malicious filepath and download_url…
- risk 0.57cvss 8.8epss 0.01
File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.
- risk 0.57cvss 8.8epss 0.01
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.
- risk 0.57cvss 8.8epss 0.01
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.
- risk 0.57cvss 8.8epss 0.00
An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html
- risk 0.57cvss 8.8epss 0.00
An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin.
- risk 0.57cvss 8.8epss 0.00
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
- risk 0.52cvss 9.1epss 0.00
Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.
- risk 0.48cvss 7.3epss 0.01
Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request.
- risk 0.47cvss 7.2epss 0.00
jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.