Ofcms Project

Ofcms

20 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2025-1557

Exploit
  • EPSS 0.11%
  • Veröffentlicht 22.02.2025 13:15:12
  • Zuletzt bearbeitet 04.06.2025 19:14:47

A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the...

6.5

CVE-2024-48236

Exploit
  • EPSS 0.34%
  • Veröffentlicht 25.10.2024 22:15:02
  • Zuletzt bearbeitet 18.04.2025 01:09:16

An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of the ofcms-admin\src\main\java\com\ofsoft\cms\core\uitle\FileUtils.java file

6.5

CVE-2024-48235

Exploit
  • EPSS 0.34%
  • Veröffentlicht 25.10.2024 22:15:02
  • Zuletzt bearbeitet 18.04.2025 01:08:54

An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file.

3.5

CVE-2024-9411

  • EPSS 0.13%
  • Veröffentlicht 01.10.2024 20:15:05
  • Zuletzt bearbeitet 13.11.2025 15:02:41

A vulnerability classified as problematic has been found in OFCMS 1.1.2. This affects the function add of the file /admin/system/dict/add.json?sqlid=system.dict.save. The manipulation of the argument dict_value leads to cross site scripting. It is po...

9.8

CVE-2024-34256

Exploit
  • EPSS 0.37%
  • Veröffentlicht 14.05.2024 16:17:23
  • Zuletzt bearbeitet 03.06.2025 16:38:48

OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.

5.4

CVE-2023-51807

Exploit
  • EPSS 0.18%
  • Veröffentlicht 16.01.2024 23:15:08
  • Zuletzt bearbeitet 20.06.2025 18:15:23

Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component.

8.8

CVE-2023-24760

Exploit
  • EPSS 0.62%
  • Veröffentlicht 16.03.2023 02:15:08
  • Zuletzt bearbeitet 21.11.2024 07:48:22

An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.

6.1

CVE-2022-29653

  • EPSS 0.22%
  • Veröffentlicht 02.06.2022 14:15:50
  • Zuletzt bearbeitet 21.11.2024 06:59:30

OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json.

5.5

CVE-2022-27960

Exploit
  • EPSS 0.11%
  • Veröffentlicht 10.04.2022 21:15:09
  • Zuletzt bearbeitet 21.11.2024 06:56:32

Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' personal information.

5.4

CVE-2022-27961

Exploit
  • EPSS 0.19%
  • Veröffentlicht 10.04.2022 21:15:09
  • Zuletzt bearbeitet 21.11.2024 06:56:32

A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment text box.