jupo records

7 published records for vendor jupo.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 14.3%
Median publish → KEV: No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

7 records

CVE records
Action	CVE	Vulnerability	Severity	EPSS · Published
39Monitor	CVE-2024-25169Proof of concept	An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.jupo · mezzanine · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	1.1%Feb 28, 2024
36Monitor	CVE-2024-25170Proof of concept	An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.jupo · mezzanine · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.1	0.8%Feb 28, 2024
24Monitor	CVE-2020-19002No exploit	Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the componenjupo · mezzanine · CWE-79 pre-auth RCE XSS	Medium6.1	1.1%Aug 27, 2021
24Monitor	CVE-2025-29573No exploit	Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.jupo · mezzanine · CWE-79 Pre-auth XSS	Medium6.1	0.2%May 5, 2025
19Monitor	CVE-2025-50481Proof of concept	A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitraryjupo · mezzanine · CWE-79 RCE XSS	Medium4.8	0.6%Jul 23, 2025
19Monitor	CVE-2018-16632No exploit	Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.jupo · mezzanine · CWE-79 XSS	Medium4.8	0.6%Dec 28, 2018
19Monitor	CVE-2025-6050No exploit	Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interfacejupo · mezzanine · CWE-79 XSS	Medium4.8	0.3%Jun 17, 2025

CVE-2024-25169
39Monitor
An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
jupo · mezzanineFeb 28, 2024
CVE-2024-25170
36Monitor
An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
jupo · mezzanineFeb 28, 2024
CVE-2020-19002
24Monitor
Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the componen
MediumCVSS 6.1No exploitEPSS 1%
- pre-auth RCE
- XSS
jupo · mezzanineAug 27, 2021
CVE-2025-29573
24Monitor
Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
jupo · mezzanineMay 5, 2025
CVE-2025-50481
19Monitor
A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary
MediumCVSS 4.8Proof of conceptEPSS 0%
- RCE
- XSS
jupo · mezzanineJul 23, 2025
CVE-2018-16632
19Monitor
Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.
MediumCVSS 4.8No exploitEPSS 0%
- XSS
jupo · mezzanineDec 28, 2018
CVE-2025-6050
19Monitor
Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface
MediumCVSS 4.8No exploitEPSS 0%
- XSS
jupo · mezzanineJun 17, 2025