flycms project records

19 published records for vendor flycms project.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

19 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2024-22699No exploit	FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save.flycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Jan 18, 2024
35Monitor	CVE-2020-36065No exploit	Cross Site Request Forgery (CSRF) vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/admiflycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	May 8, 2023
35Monitor	CVE-2024-22603No exploit	FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add_linkflycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Jan 18, 2024
35Monitor	CVE-2024-22592No exploit	FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_updateflycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Jan 18, 2024
35Monitor	CVE-2024-22593No exploit	FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/add_group_saveflycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Jan 18, 2024
35Monitor	CVE-2024-22818No exploit	FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword_saveflycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Jan 18, 2024
35Monitor	CVE-2024-22817No exploit	FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagteflycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Jan 18, 2024
35Monitor	CVE-2024-22819No exploit	FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update.flycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Jan 18, 2024
35Monitor	CVE-2024-22591No exploit	FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_save.flycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Jan 18, 2024
35Monitor	CVE-2023-52072No exploit	FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig_updagte.flycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Jan 8, 2024
35Monitor	CVE-2023-52074No exploit	FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updagte.flycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Jan 8, 2024
35Monitor	CVE-2024-22568No exploit	FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/del.flycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Jan 18, 2024
35Monitor	CVE-2023-52073No exploit	FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte.flycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Jan 8, 2024
35Monitor	CVE-2024-22601No exploit	FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/scorerule_saveflycms project · flycms · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Jan 18, 2024
30Monitor	CVE-2020-19613No exploit	Server Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS version 20190503.flycms project · flycms · CWE-918 Pre-auth SSRF	High7.5	—	1.2%	Apr 1, 2021
29Monitor	CVE-2024-27694No exploit	FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the /system/share/ztree_category_edit.flycms project · flycms · CWE-352 CSRF	High7.4	—	0.2%	Mar 4, 2024
24Monitor	CVE-2024-21732No exploit	FlyCms through abbaa5a allows XSS via the permission management feature.flycms project · flycms · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Jan 1, 2024
21Monitor	CVE-2024-22548No exploit	FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the system website settings website name section.flycms project · flycms · CWE-79 XSS	Medium5.4	—	0.4%	Jan 18, 2024
21Monitor	CVE-2024-22549No exploit	FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section.flycms project · flycms · CWE-79 XSS	Medium5.4	—	0.3%	Jan 18, 2024

CVE-2024-22699
35Monitor
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 18, 2024
CVE-2020-36065
35Monitor
Cross Site Request Forgery (CSRF) vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/admi
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsMay 8, 2023
CVE-2024-22603
35Monitor
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add_link
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 18, 2024
CVE-2024-22592
35Monitor
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_update
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 18, 2024
CVE-2024-22593
35Monitor
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/add_group_save
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 18, 2024
CVE-2024-22818
35Monitor
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword_save
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 18, 2024
CVE-2024-22817
35Monitor
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 18, 2024
CVE-2024-22819
35Monitor
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 18, 2024
CVE-2024-22591
35Monitor
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_save.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 18, 2024
CVE-2023-52072
35Monitor
FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig_updagte.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 8, 2024
CVE-2023-52074
35Monitor
FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updagte.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 8, 2024
CVE-2024-22568
35Monitor
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/del.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 18, 2024
CVE-2023-52073
35Monitor
FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 8, 2024
CVE-2024-22601
35Monitor
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/scorerule_save
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flycms project · flycmsJan 18, 2024
CVE-2020-19613
30Monitor
Server Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS version 20190503.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- SSRF
flycms project · flycmsApr 1, 2021
CVE-2024-27694
29Monitor
FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the /system/share/ztree_category_edit.
HighCVSS 7.4No exploitEPSS 0%
- CSRF
flycms project · flycmsMar 4, 2024
CVE-2024-21732
24Monitor
FlyCms through abbaa5a allows XSS via the permission management feature.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
flycms project · flycmsJan 1, 2024
CVE-2024-22548
21Monitor
FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the system website settings website name section.
MediumCVSS 5.4No exploitEPSS 0%
- XSS
flycms project · flycmsJan 18, 2024
CVE-2024-22549
21Monitor
FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section.
MediumCVSS 5.4No exploitEPSS 0%
- XSS
flycms project · flycmsJan 18, 2024