CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 09/03/2023 |
| CVE-2022-42234 | 高危8.8 | There is a file inclusion vulnerability in the template management module in UCMS 1.6 | 14/10/2022 |
| CVE-2022-38527 | 中危6.1 | UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page. | 19/09/2022 |
| CVE-2022-38297 | 严重9.8 | UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning. | 12/09/2022 |
| CVE-2022-35426 | 严重9.8 | UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file. | 10/08/2022 |
| CVE-2022-28444 | 高危7.5 | UCMS v1.6 was discovered to contain an arbitrary file read vulnerability. | 21/04/2022 |
| CVE-2022-28443 | 严重9.1 | UCMS v1.6 was discovered to contain an arbitrary file deletion vulnerability. | 21/04/2022 |
| CVE-2022-28440 | 高危8.8 | An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file. | 21/04/2022 |
| CVE-2020-20781 | 中危5.4 | A stored cross-site scripting (XSS) vulnerability in /ucms/index.php?do=list_edit of UCMS 1.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the title, key words, description or content text fields. | 29/09/2021 |
| CVE-2021-25809 | 中危5.3 | UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php. | 23/07/2021 |
| CVE-2020-25537 | 严重9.8 | File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission. | 30/11/2020 |
| CVE-2020-25483 | 严重9.8 | An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server. | 23/10/2020 |
| CVE-2020-24981 | 中危5.3 | An Incorrect Access Control vulnerability exists in /ucms/chk.php in UCMS 1.4.8. This results in information leak via an error message caused by directly accessing the website built by UCMS. | 04/09/2020 |
| CVE-2019-12251 | 高危8.8 | sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter. | 21/05/2019 |
| CVE-2018-16804 | 中危6.1 | An issue was discovered in UCMS 1.4.6. There is XSS in the title bar, as demonstrated by a do=list request. | 07/03/2019 |
| CVE-2018-20601 | 中危4.8 | UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action. | 30/12/2018 |
| CVE-2018-20600 | 中危6.1 | sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action. | 30/12/2018 |
| CVE-2018-20599 | 高危8.8 | UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action. | 30/12/2018 |