DR
Vendor
Dromara
22
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-93961 | UJ UJCMS Dromara | 5.3 | Sep 20 | Dromara UJCMS UserController UserController.java usernameExist improper authorization |
| CVE-2026-78140 | UJ UJCMS Dromara | 4.7 | Aug 23 | Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine |
| CVE-2026-2954 | UJ UJCMS Dromara | 9.8 | Feb 22 | Dromara UJCMS ImportDataController import-channel importChanel injection |
| CVE-2026-2953 | UJ UJCMS Dromara | 9.1 | Feb 22 | Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal |
| CVE-2025-2491 | UJ Ujcms Ujcms | 5.4 | Mar 18 | Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting |
| CVE-2025-2490 | UJ Ujcms Ujcms | 5.4 | Mar 18 | Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting |
| CVE-2025-25772 | JS Jspxcms Ujcms | 5.1 | Feb 21 | A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted… |
| CVE-2024-55451 | UJ Ujcms Ujcms | 4.8 | Dec 16 | A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3 |
| CVE-2024-55452 | UJ Ujcms Ujcms | 5.4 | Dec 16 | A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items |
| CVE-2024-12483 | UJ Ujcms Ujcms | 5.9 | Dec 11 | Dromara UJCMS User ID id authorization |
| CVE-2024-1257 | JS Jspxcms Ujcms | 6.1 | Feb 6 | Jspxcms find_text.do cross site scripting |
| CVE-2024-1256 | JS Jspxcms Ujcms | 4.3 | Feb 6 | Jspxcms filter_text.do cross site scripting |
| CVE-2024-0599 | JS Jspxcms Ujcms | 5.4 | Jan 16 | Jspxcms Document Management Page InfoController.java cross site scripting |
| CVE-2023-51806 | UJ Ujcms Ujcms | 5.4 | Jan 12 | File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file |
| CVE-2023-51350 | UJ Ujcms Ujcms | 9.8 | Jan 11 | A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-For function in the… |
| CVE-2023-3231 | UJ Ujcms Ujcms | 6.5 | Jun 14 | UJCMS ZIP Package information disclosure |
| CVE-2023-34878 | UJ Ujcms Ujcms | 7.5 | Jun 14 | An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip |
| CVE-2023-34865 | UJ Ujcms Ujcms | 9.8 | Jun 14 | Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature |
| CVE-2023-34747 | UJ Ujcms Ujcms | 9.8 | Jun 14 | File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload |
| CVE-2023-24369 | UJ Ujcms Ujcms | 6.1 | Feb 17 | A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter under… |
| CVE-2022-28090 | JS Jspxcms Ujcms | 6.5 | May 4 | Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url= |
| CVE-2022-23329 | JS Jspxcms Ujcms | 9.8 | Feb 4 | A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files |