| CVE-2025-3563 | ALTO7.2 | A vulnerability was found in WuzhiCMS 4.1. It has been rated as critical. Affected by this issue is the function Set of the file /index.php?m=attachment&f=index&_su=wuzhicms&v=set&submit=1 of the component Setting Handler. The manipulation of the argument Setting leads to code injection. The attack may be launched remo | 14/04/2025 |
| CVE-2025-25916 | MEDIO5.4 | wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php. | 28/02/2025 |
| CVE-2025-0480 | MEDIO4.3 | A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. The manipulation of the argument sphinxhost/sphinxport leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been | 15/01/2025 |
| CVE-2024-10505 | ALTO7.2 | A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | 30/10/2024 |
| CVE-2024-32206 | MEDIO4.6 | A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $formdata parameter. | 19/04/2024 |
| CVE-2024-31008 | MEDIO6.5 | An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file. | 03/04/2024 |
| CVE-2023-52064 | CRÍTICO9.8 | Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php. | 10/01/2024 |
| CVE-2023-46482 | CRÍTICO9.8 | SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/database/admin/index.php component. | 01/11/2023 |
| CVE-2020-36037 | ALTO8.8 | An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php. | 11/08/2023 |
| CVE-2020-21325 | ALTO8.8 | An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file. | 20/06/2023 |
| CVE-2020-20413 | CRÍTICO9.8 | SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php. | 20/06/2023 |
| CVE-2023-31860 | MEDIO5.4 | Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system. | 23/05/2023 |
| CVE-2023-30123 | MEDIO5.4 | wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings. | 28/04/2023 |
| CVE-2022-36168 | BAJO2.7 | A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php: | 26/08/2022 |
| CVE-2020-19897 | MEDIO6.1 | A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter. | 28/06/2022 |
| CVE-2021-41654 | CRÍTICO9.8 | SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php | 16/06/2022 |
| CVE-2022-27431 | CRÍTICO9.8 | Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php. | 04/05/2022 |
| CVE-2020-19770 | MEDIO5.4 | A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie. | 21/12/2021 |
| CVE-2020-28145 | ALTO7.5 | Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information. | 12/10/2021 |
| CVE-2020-20124 | ALTO8.8 | Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php. | 28/09/2021 |