Jizhicms

Jizhicms

36 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2025-25784

Exploit
  • EPSS 0.71%
  • Veröffentlicht 26.02.2025 15:15:26
  • Zuletzt bearbeitet 10.04.2025 17:42:20

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.

6.1

CVE-2024-34255

Exploit
  • EPSS 0.33%
  • Veröffentlicht 08.05.2024 13:15:08
  • Zuletzt bearbeitet 13.06.2025 13:00:45

jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function.

7.3

CVE-2024-33338

Exploit
  • EPSS 1.33%
  • Veröffentlicht 29.04.2024 18:15:07
  • Zuletzt bearbeitet 23.04.2025 01:28:50

Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request.

9.8

CVE-2024-32161

Exploit
  • EPSS 0.15%
  • Veröffentlicht 17.04.2024 18:15:16
  • Zuletzt bearbeitet 18.04.2025 16:49:30

jizhiCMS 2.5 suffers from a File upload vulnerability.

9.8

CVE-2023-51154

Exploit
  • EPSS 0.09%
  • Veröffentlicht 04.01.2024 19:15:08
  • Zuletzt bearbeitet 18.06.2025 16:15:23

Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.

8.8

CVE-2023-50692

Exploit
  • EPSS 1.84%
  • Veröffentlicht 28.12.2023 06:15:44
  • Zuletzt bearbeitet 17.04.2025 21:15:47

File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.

6.5

CVE-2023-43836

Exploit
  • EPSS 0.06%
  • Veröffentlicht 02.10.2023 21:15:34
  • Zuletzt bearbeitet 21.11.2024 08:24:51

There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information

7.2

CVE-2023-38948

Exploit
  • EPSS 0.2%
  • Veröffentlicht 03.08.2023 16:15:12
  • Zuletzt bearbeitet 21.11.2024 08:14:30

An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin.

9.8

CVE-2023-2927

Exploit
  • EPSS 0.09%
  • Veröffentlicht 27.05.2023 09:15:10
  • Zuletzt bearbeitet 21.11.2024 07:59:34

A vulnerability was found in JIZHICMS 2.4.5. It has been classified as critical. Affected is the function index of the file TemplateController.php. The manipulation of the argument webapi leads to server-side request forgery. It is possible to launch...

5.4

CVE-2023-31862

Exploit
  • EPSS 0.11%
  • Veröffentlicht 19.05.2023 13:15:08
  • Zuletzt bearbeitet 21.01.2025 20:15:30

jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published in the front end is only filtered in the front end, without being filtered in the background, which allows attackers to publish an article containing ma...