Login Request a demo
PU
Product
PublicCMS
by Sanluan · last CVE Oct 13, 2026
56
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities56In the news0Timeline
Severity mix
Critical 11High 18Medium 26Low 1
Severity
All severities56Critical11High18Medium26Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add PublicCMS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-65840
8.8
0%
Dec 1
PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController
Affected: 5.202506.b
CVE-2024-40546
8.8
1%
Jul 12
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file
Affected: through 4.0.202302.e
CVE-2024-40552
8.8
1%
Jul 12
PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java
Affected: through 4.0.202302.e
CVE-2024-40549
8.8
1%
Jul 12
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted…
Affected: through 4.0.202302.e
CVE-2024-40543
8.8
0%
Jul 12
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage
Affected: through 4.0.202302.e
CVE-2024-40544
8.8
0%
Jul 12
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit
Affected: through 4.0.202302.e
CVE-2024-40545
8.8
1%
Jul 12
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted…
Affected: through 4.0.202302.e
CVE-2024-40548
8.8
1%
Jul 12
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file
Affected: through 4.0.202302.e
CVE-2024-40551
8.8
0%
Jul 12
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted…
Affected: through 4.0.202302.e
CVE-2024-40550
8.8
1%
Jul 12
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary code via uploading…
Affected: through 4.0.202302.e
CVE-2024-31759
8.8
1%
Apr 16
An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function
Affected: 4.0.202302.e
CVE-2018-11500
8.8
1%
May 26
An issue was discovered in PublicCMS V4.0.20180210
Affected: 4.0.20180210
CVE-2025-69437
8.7
0%
Feb 27
PublicCMS v5.202506.d and earlier is vulnerable to stored XSS
Affected: through 5.202506.d
CVE-2025-57516
8.2
1%
Sep 29
OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME,…
Affected: 5.202506.a; 5.202506.b
CVE-2026-1112
8.1
0%
Jan 18
Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization
Affected: 5.202506.a; 5.202506.b; 5.202506.c; 5.202506.d
CVE-2025-65838
7.5
0%
Dec 1
PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method
Affected: 5.202506.b
CVE-2026-1111
7.2
1%
Jan 18
Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal
Affected: 5.202506.a; 5.202506.b; 5.202506.c; 5.202506.d
CVE-2024-42523
7.2
1%
Aug 23
publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData
Affected: through 4.0.202302.e
Showing 18