CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 17/12/2025 |
| CVE-2023-53914 | CRITICAL9.8 | UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full syst | 17/12/2025 |
| CVE-2020-12704 | MEDIUM6.1 | UliCMS before 2020.2 has PageController stored XSS. | 07/05/2020 |
| CVE-2020-12703 | MEDIUM6.1 | UliCMS before 2020.2 has XSS during PackageController uninstall. | 07/05/2020 |
| CVE-2019-11398 | MEDIUM6.1 | Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon. | 08/05/2019 |