Filtered by vendor Publiccms Subscriptions
Total 32 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-34852 1 Publiccms 1 Publiccms 2024-12-18 9.8 Critical
PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.
CVE-2024-11070 2 Publiccms, Sanluan 2 Publiccms, Publiccms 2024-11-23 3.5 Low
A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-40552 1 Publiccms 1 Publiccms 2024-11-21 8.8 High
PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java.
CVE-2024-40551 1 Publiccms 1 Publiccms 2024-11-21 6.2 Medium
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40550 1 Publiccms 1 Publiccms 2024-11-21 8.8 High
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40549 1 Publiccms 1 Publiccms 2024-11-21 8.8 High
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40548 1 Publiccms 1 Publiccms 2024-11-21 8.8 High
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40547 1 Publiccms 1 Publiccms 2024-11-21 6.5 Medium
PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace.
CVE-2024-40546 1 Publiccms 1 Publiccms 2024-11-21 8.8 High
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40545 1 Publiccms 1 Publiccms 2024-11-21 7.2 High
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40544 1 Publiccms 1 Publiccms 2024-11-21 8.8 High
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit.
CVE-2024-40543 1 Publiccms 1 Publiccms 2024-11-21 6.4 Medium
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage.
CVE-2023-51252 1 Publiccms 1 Publiccms 2024-11-21 5.4 Medium
PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing.
CVE-2023-48204 1 Publiccms 1 Publiccms 2024-11-21 6.5 Medium
An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component.
CVE-2023-46990 1 Publiccms 1 Publiccms 2024-11-21 9.8 Critical
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
CVE-2022-3950 1 Publiccms 1 Publiccms 2024-11-21 3.5 Low
A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.js of the component Tab Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a972dc9b1c94aea2d84478bf26283904c21e4ca2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213456.
CVE-2022-29784 1 Publiccms 1 Publiccms 2024-11-21 5.3 Medium
PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java.
CVE-2022-23389 1 Publiccms 1 Publiccms 2024-11-21 9.8 Critical
PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.
CVE-2021-40881 1 Publiccms 1 Publiccms 2024-11-21 9.8 Critical
An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.
CVE-2021-27693 1 Publiccms 1 Publiccms 2024-11-21 9.8 Critical
Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.