Login Request a demo
UJ
Product
UJCMS
by Dromara · last CVE Sep 20, 2026
16
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities16In the news0Timeline
Severity mix
Critical 5High 1Medium 10Low 0
Severity
All severities16Critical5High1Medium10Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add UJCMS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-3231
6.5
1%
Jun 14
A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic
Affected: through 6.0.2
CVE-2023-24369
6.1
0%
Feb 17
A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter under…
Affected: 4.1.3 before 5.5.1
CVE-2024-12483
5.9
4%
Dec 11
Dromara UJCMS User ID id authorization
Affected: before 9.6.3
CVE-2025-2491
5.4
0%
Mar 18
Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting
Affected: 9.7.5
CVE-2025-2490
5.4
0%
Mar 18
Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting
Affected: 9.7.5
CVE-2024-55452
5.4
0%
Dec 16
A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items
Affected: 9.6.3
CVE-2023-51806
5.4
1%
Jan 12
File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file
Affected: 8.0.2
CVE-2026-93961
5.3
1%
Sep 20
Dromara UJCMS UserController UserController.java usernameExist improper authorization
Affected: 12.3.0; 12.3.1
CVE-2024-55451
4.8
0%
Dec 16
A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3
Affected: 9.6.3
CVE-2026-78140
4.7
0%
Aug 23
Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine
Affected: 10.1.0; 10.1.1; 10.1.2; 10.1.3
Showing 10