ujcms kayıtları

ujcms üreticisine ait 20 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren: 0 · %0
Silahlaştırılmış: 0 · %0
Pre-auth RCE: 3
Düzeltme kaydı olan: %5
Yayından KEV’e ortanca: KEV’e giren kayıt yok

Yıllara göre kayıt

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

Saldırı profili

Tüm kayıtlar

20 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
45Planlayın	CVE-2023-34747İstismar yok	File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.ujcms · ujcms · CWE-434 Kimlik doğrulamasız Dosya yükleme	Kritik9,8	—	%20,0	14 Haz 2023
43Planlayın	CVE-2022-23329İstismar yok	A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands viaujcms · jspxcms · CWE-434 pre-auth RCE Dosya yükleme	Kritik9,8	—	%14,4	4 Şub 2022
39İzleyin	CVE-2023-51350İstismar yok	A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script ujcms · ujcms · CWE-290 pre-auth RCE Kimlik doğrulama atlatma	Kritik9,8	—	%1,3	11 Oca 2024
39İzleyin	CVE-2023-34865İstismar yok	Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.ujcms · ujcms · CWE-22 Kimlik doğrulamasız Yol geçişi	Kritik9,8	—	%1,2	14 Haz 2023
30İzleyin	CVE-2023-34878İstismar yok	An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-hujcms · ujcms · CWE-203 Kimlik doğrulamasız	Yüksek7,5	—	%0,7	14 Haz 2023
26İzleyin	CVE-2024-12483Kavram kanıtı	Dromara UJCMS User ID id authorizationujcms · ujcms · CWE-285 Kimlik doğrulamasız Erişim denetimi (IDOR)	Orta6,3	—	%3,6	11 Ara 2024
26İzleyin	CVE-2022-28090İstismar yok	Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=.ujcms · jspxcms · CWE-918 Kimlik doğrulamasız SSRF	Orta6,5	—	%1,1	4 May 2022
26İzleyin	CVE-2023-3231İstismar yok	UJCMS ZIP Package information disclosureujcms · ujcms · CWE-200 Bilgi sızıntısı	Orta6,5	—	%0,8	14 Haz 2023
24İzleyin	CVE-2024-1257İstismar yok	Jspxcms find_text.do cross site scriptingujcms · jspxcms · CWE-79 Kimlik doğrulamasız XSS	Orta6,1	—	%0,5	6 Şub 2024
24İzleyin	CVE-2023-24369İstismar yok	A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a craftedujcms · ujcms · CWE-79 pre-auth RCE XSS	Orta6,1	—	%0,4	17 Şub 2023
21İzleyin	CVE-2023-51806İstismar yok	File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.ujcms · ujcms · CWE-434 RCE Dosya yükleme	Orta5,4	—	%0,6	12 Oca 2024
21İzleyin	CVE-2024-0599İstismar yok	Jspxcms Document Management Page InfoController.java cross site scriptingujcms · jspxcms · CWE-79 XSS	Orta5,4	—	%0,5	16 Oca 2024
21İzleyin	CVE-2024-55452İstismar yok	A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carouselujcms · ujcms · CWE-601 Açık yönlendirme	Orta5,4	—	%0,3	16 Ara 2024
20İzleyin	CVE-2025-25772İstismar yok	A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Aujcms · jspxcms · CWE-352 CSRF	Orta5,1	—	%0,2	21 Şub 2025
19İzleyin	CVE-2025-2491İstismar yok	Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scriptingujcms · ujcms · CWE-79 XSS	Orta4,8	—	%0,3	18 Mar 2025
19İzleyin	CVE-2025-2490İstismar yok	Dromara ujcms File Upload WebFileUploadController.java upload cross site scriptingujcms · ujcms · CWE-79 XSS	Orta4,8	—	%0,3	18 Mar 2025
19İzleyin	CVE-2024-55451İstismar yok	A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3.ujcms · ujcms · CWE-79 RCE XSS	Orta4,8	—	%0,3	16 Ara 2024
17İzleyin	CVE-2024-1256İstismar yok	Jspxcms filter_text.do cross site scriptingujcms · jspxcms · CWE-79 Kimlik doğrulamasız XSS	Orta4,3	—	%0,6	6 Şub 2024
8İzleyin	CVE-2026-2953İstismar yok	Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversalujcms · ujcms · CWE-22 Yol geçişi	Düşük2,1	—	%1,0	22 Şub 2026
8İzleyin	CVE-2026-2954İstismar yok	Dromara UJCMS ImportDataController import-channel importChanel injectionujcms · ujcms · CWE-74	Düşük2,1	—	%0,7	22 Şub 2026

CVE-2023-34747
45Planlayın
File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.
KritikCVSS 9,8İstismar yokEPSS %20
- Kimlik doğrulamasız
- Dosya yükleme
ujcms · ujcms14 Haz 2023
CVE-2022-23329
43Planlayın
A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via
KritikCVSS 9,8İstismar yokEPSS %14
- pre-auth RCE
- Dosya yükleme
ujcms · jspxcms4 Şub 2022
CVE-2023-51350
39İzleyin
A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script
KritikCVSS 9,8İstismar yokEPSS %1
- pre-auth RCE
- Kimlik doğrulama atlatma
ujcms · ujcms11 Oca 2024
CVE-2023-34865
39İzleyin
Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.
KritikCVSS 9,8İstismar yokEPSS %1
- Kimlik doğrulamasız
- Yol geçişi
ujcms · ujcms14 Haz 2023
CVE-2023-34878
30İzleyin
An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-h
YüksekCVSS 7,5İstismar yokEPSS %1
- Kimlik doğrulamasız
ujcms · ujcms14 Haz 2023
CVE-2024-12483
26İzleyin
Dromara UJCMS User ID id authorization
OrtaCVSS 6,3Kavram kanıtıEPSS %4
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
ujcms · ujcms11 Ara 2024
CVE-2022-28090
26İzleyin
Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=.
OrtaCVSS 6,5İstismar yokEPSS %1
- Kimlik doğrulamasız
- SSRF
ujcms · jspxcms4 May 2022
CVE-2023-3231
26İzleyin
UJCMS ZIP Package information disclosure
OrtaCVSS 6,5İstismar yokEPSS %1
- Bilgi sızıntısı
ujcms · ujcms14 Haz 2023
CVE-2024-1257
24İzleyin
Jspxcms find_text.do cross site scripting
OrtaCVSS 6,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
ujcms · jspxcms6 Şub 2024
CVE-2023-24369
24İzleyin
A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted
OrtaCVSS 6,1İstismar yokEPSS %0
- pre-auth RCE
- XSS
ujcms · ujcms17 Şub 2023
CVE-2023-51806
21İzleyin
File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.
OrtaCVSS 5,4İstismar yokEPSS %1
- RCE
- Dosya yükleme
ujcms · ujcms12 Oca 2024
CVE-2024-0599
21İzleyin
Jspxcms Document Management Page InfoController.java cross site scripting
OrtaCVSS 5,4İstismar yokEPSS %1
- XSS
ujcms · jspxcms16 Oca 2024
CVE-2024-55452
21İzleyin
A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel
OrtaCVSS 5,4İstismar yokEPSS %0
- Açık yönlendirme
ujcms · ujcms16 Ara 2024
CVE-2025-25772
20İzleyin
A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add A
OrtaCVSS 5,1İstismar yokEPSS %0
- CSRF
ujcms · jspxcms21 Şub 2025
CVE-2025-2491
19İzleyin
Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting
OrtaCVSS 4,8İstismar yokEPSS %0
- XSS
ujcms · ujcms18 Mar 2025
CVE-2025-2490
19İzleyin
Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting
OrtaCVSS 4,8İstismar yokEPSS %0
- XSS
ujcms · ujcms18 Mar 2025
CVE-2024-55451
19İzleyin
A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3.
OrtaCVSS 4,8İstismar yokEPSS %0
- RCE
- XSS
ujcms · ujcms16 Ara 2024
CVE-2024-1256
17İzleyin
Jspxcms filter_text.do cross site scripting
OrtaCVSS 4,3İstismar yokEPSS %1
- Kimlik doğrulamasız
- XSS
ujcms · jspxcms6 Şub 2024
CVE-2026-2953
8İzleyin
Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal
DüşükCVSS 2,1İstismar yokEPSS %1
- Yol geçişi
ujcms · ujcms22 Şub 2026
CVE-2026-2954
8İzleyin
Dromara UJCMS ImportDataController import-channel importChanel injection
DüşükCVSS 2,1İstismar yokEPSS %1
ujcms · ujcms22 Şub 2026