jpress records

19 published records for vendor jpress.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 3
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

19 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2021-45807No exploit	jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.jpress · jpress pre-auth RCE	Critical9.8	—	2.1%	Jan 13, 2022
39Monitor	CVE-2024-50919No exploit	Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp.jpress · jpress · CWE-94 pre-auth RCE File upload	Critical9.8	—	1.2%	Nov 18, 2024
36Monitor	CVE-2022-23330No exploit	A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code vijpress · jpress RCE	High8.8	—	1.9%	Feb 4, 2022
35Monitor	CVE-2021-45806No exploit	jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.jpress · jpress · CWE-94 RCE	High8.8	—	1.4%	Jan 13, 2022
35Monitor	CVE-2021-46114No exploit	jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail.jpress · jpress · CWE-94 RCE	High8.8	—	1.3%	Jan 26, 2022
35Monitor	CVE-2021-45808No exploit	jpress v4.2.0 allows users to register an account by default.jpress · jpress · CWE-434 File upload	High8.8	—	1.3%	Jan 19, 2022
35Monitor	CVE-2024-43033No exploit	JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to Attachmejpress · jpress · CWE-69 RCE File upload	High8.8	—	1.0%	Aug 21, 2024
30Monitor	CVE-2024-32358No exploit	An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a jpress · jpress · CWE-94 pre-auth RCE	High7.5	—	0.7%	Apr 25, 2024
30Monitor	CVE-2024-46468No exploit	A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitivejpress · jpress · CWE-918 Pre-auth SSRF	High7.5	—	0.4%	Oct 11, 2024
29Monitor	CVE-2021-46117No exploit	jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail.jpress · jpress · CWE-94 RCE	High7.2	—	2.8%	Jan 26, 2022
29Monitor	CVE-2021-46118No exploit	jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail.jpress · jpress · CWE-94 RCE	High7.2	—	2.3%	Jan 26, 2022
29Monitor	CVE-2021-46116No exploit	jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall.jpress · jpress · CWE-434 RCE File upload	High7.2	—	2.2%	Jan 26, 2022
28Monitor	CVE-2021-46115No exploit	jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile.jpress · jpress · CWE-434 RCE File upload	High7.2	—	1.1%	Jan 26, 2022
21Monitor	CVE-2021-33347No exploit	An issue was discovered in JPress v3.3.0 and below.jpress · jpress · CWE-79 XSS	Medium5.4	—	0.5%	Jun 18, 2021
21Monitor	CVE-2024-11971No exploit	Guizhou Xiaoma Technology jpress Avatar upload cross site scriptingjpress · jpress · CWE-79 XSS	Medium5.3	—	0.5%	Nov 28, 2024
21Monitor	CVE-2019-6278No exploit	XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option.jpress · jpress · CWE-79 XSS	Medium5.4	—	0.5%	Jan 14, 2019
21Monitor	CVE-2024-12348No exploit	Guizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scriptingjpress · jpress · CWE-79 XSS	Medium5.3	—	0.4%	Dec 8, 2024
20Monitor	CVE-2024-8304No exploit	jpress Template Module edit path traversaljpress · jpress · CWE-22 Path traversal	Medium5.1	—	0.6%	Aug 29, 2024
19Monitor	CVE-2018-19170No exploit	In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstratjpress · jpress · CWE-79 XSS	Medium4.8	—	0.6%	Nov 11, 2018

CVE-2021-45807
40Plan
jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
jpress · jpressJan 13, 2022
CVE-2024-50919
39Monitor
Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp.
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- File upload
jpress · jpressNov 18, 2024
CVE-2022-23330
36Monitor
A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code vi
HighCVSS 8.8No exploitEPSS 2%
- RCE
jpress · jpressFeb 4, 2022
CVE-2021-45806
35Monitor
jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.
HighCVSS 8.8No exploitEPSS 1%
- RCE
jpress · jpressJan 13, 2022
CVE-2021-46114
35Monitor
jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail.
HighCVSS 8.8No exploitEPSS 1%
- RCE
jpress · jpressJan 26, 2022
CVE-2021-45808
35Monitor
jpress v4.2.0 allows users to register an account by default.
HighCVSS 8.8No exploitEPSS 1%
- File upload
jpress · jpressJan 19, 2022
CVE-2024-43033
35Monitor
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to Attachme
HighCVSS 8.8No exploitEPSS 1%
- RCE
- File upload
jpress · jpressAug 21, 2024
CVE-2024-32358
30Monitor
An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a
HighCVSS 7.5No exploitEPSS 1%
- pre-auth RCE
jpress · jpressApr 25, 2024
CVE-2024-46468
30Monitor
A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitive
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
jpress · jpressOct 11, 2024
CVE-2021-46117
29Monitor
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail.
HighCVSS 7.2No exploitEPSS 3%
- RCE
jpress · jpressJan 26, 2022
CVE-2021-46118
29Monitor
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail.
HighCVSS 7.2No exploitEPSS 2%
- RCE
jpress · jpressJan 26, 2022
CVE-2021-46116
29Monitor
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall.
HighCVSS 7.2No exploitEPSS 2%
- RCE
- File upload
jpress · jpressJan 26, 2022
CVE-2021-46115
28Monitor
jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile.
HighCVSS 7.2No exploitEPSS 1%
- RCE
- File upload
jpress · jpressJan 26, 2022
CVE-2021-33347
21Monitor
An issue was discovered in JPress v3.3.0 and below.
MediumCVSS 5.4No exploitEPSS 1%
- XSS
jpress · jpressJun 18, 2021
CVE-2024-11971
21Monitor
Guizhou Xiaoma Technology jpress Avatar upload cross site scripting
MediumCVSS 5.3No exploitEPSS 1%
- XSS
jpress · jpressNov 28, 2024
CVE-2019-6278
21Monitor
XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option.
MediumCVSS 5.4No exploitEPSS 1%
- XSS
jpress · jpressJan 14, 2019
CVE-2024-12348
21Monitor
Guizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scripting
MediumCVSS 5.3No exploitEPSS 0%
- XSS
jpress · jpressDec 8, 2024
CVE-2024-8304
20Monitor
jpress Template Module edit path traversal
MediumCVSS 5.1No exploitEPSS 1%
- Path traversal
jpress · jpressAug 29, 2024
CVE-2018-19170
19Monitor
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrat
MediumCVSS 4.8No exploitEPSS 1%
- XSS
jpress · jpressNov 11, 2018