PU
Product
PublicCMS
56
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 11High 18Medium 26Low 1
Watch
Add PublicCMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-8738 | 6.5 | May 17 | Sanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error Affected: 5.202506.d |
| CVE-2024-40547 | 6.5 | Jul 12 | PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace Affected: through 4.0.202302.e |
| CVE-2023-48204 | 6.5 | Nov 15 | An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component Affected: 4.0.202302.e |
| CVE-2018-12494 | 6.5 | Jun 15 | An issue was discovered in PublicCMS V4.0.20180210 Affected: 4.0.20180210 |
| CVE-2018-12493 | 6.5 | Jun 15 | An issue was discovered in PublicCMS V4.0.20180210 Affected: 4.0.20180210 |
| CVE-2026-8740 | 6.3 | May 17 | Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine Affected: 5.202506.d |
| CVE-2025-7953 | 6.1 | Jul 22 | Sanluan PublicCMS viewer.html redirect Affected: before 5.202506.b |
| CVE-2025-7949 | 6.1 | Jul 22 | Sanluan PublicCMS preview.html redirect Affected: before 5.202506.b |
| CVE-2022-3950 | 6.1 | Nov 11 | sanluan PublicCMS Tab dwz.min.js initLink cross site scripting Affected: before 4.0.202204.d |
| CVE-2025-65837 | 5.4 | Dec 22 | PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module Affected: 5.202506.b |
| CVE-2024-11070 | 5.4 | Nov 11 | Sanluan PublicCMS Tag Type save cross site scripting Affected: 5.202406.d |
| CVE-2023-51252 | 5.4 | Jan 10 | PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS) Affected: 4.0 |
| CVE-2020-21333 | 5.4 | Jul 9 | Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case Affected: 4.0 |
| CVE-2026-8739 | 5.3 | May 17 | Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key Affected: 5.202506.d |
| CVE-2026-8737 | 5.3 | May 17 | Sanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authentication Affected: 5.202506.d |
| CVE-2022-29784 | 5.3 | Jun 3 | PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java Affected: through 4.0.202204.a |
| CVE-2018-17368 | 5.3 | Sep 23 | An issue was discovered in PublicCMS V4.0.180825 Affected: 4.0.180825 |
| CVE-2024-11175 | 4.8 | Nov 13 | Public CMS Voting Management save cross site scripting Affected: 5.202406.d |
| CVE-2024-46410 | 4.8 | Oct 8 | PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature Affected: 4.0.202406.e |
| CVE-2018-18927 | 4.8 | Nov 4 | An issue was discovered in PublicCMS V4.0 Affected: 4.0 |
| CVE-2026-5987 | 4.7 | Apr 9 | Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine Affected: 4.0.202506.a; 4.0.202506.b; 5.202506.a; 5.202506.b; 5.202506.d; 6.202506.d |
| CVE-2026-109160 | 4.3 | Oct 13 | PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect Affected: 5.202608.a |
| CVE-2026-6797 | 4.3 | Apr 21 | Sanluan PublicCMS DocToHtmlUtils.java ZipSecureFile.setMinflateRatio resource consumption Affected: 6.202506.a; 6.202506.b; 6.202506.c; 6.202506.d |
| CVE-2026-6796 | 4.3 | Apr 21 | Sanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file Affected: 6.202506.a; 6.202506.b; 6.202506.c; 6.202506.d |
| CVE-2024-2911 | 4.3 | Mar 26 | Tianjin PubliCMS cross-site request forgery Affected: 4.0.202302.e |
| CVE-2026-2010 | 4.2 | Feb 6 | Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization Affected: 4.0.202506.a; 4.0.202506.b; 4.0.202506.c; 4.0.202506.d; 5.202506.a; 5.202506.b; +6 more |
Showing 26