ofcms project records

20 published records for vendor ofcms project.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

20 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2024-34256No exploit	OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.ofcms project · ofcms · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.7%	May 14, 2024
36Monitor	CVE-2019-9617No exploit	An issue was discovered in OFCMS before 1.1.3.ofcms project · ofcms · CWE-434 RCE File upload	High8.8	—	2.7%	Mar 6, 2019
36Monitor	CVE-2019-9609No exploit	An issue was discovered in OFCMS before 1.1.3.ofcms project · ofcms · CWE-434 RCE File upload	High8.8	—	2.7%	Mar 6, 2019
36Monitor	CVE-2019-9608No exploit	An issue was discovered in OFCMS before 1.1.3.ofcms project · ofcms · CWE-434 RCE File upload	High8.8	—	2.7%	Mar 6, 2019
36Monitor	CVE-2019-9612No exploit	An issue was discovered in OFCMS before 1.1.3.ofcms project · ofcms · CWE-434 RCE File upload	High8.8	—	2.7%	Mar 6, 2019
36Monitor	CVE-2019-9614No exploit	An issue was discovered in OFCMS before 1.1.3.ofcms project · ofcms · CWE-74 RCE	High8.8	—	2.6%	Mar 6, 2019
35Monitor	CVE-2023-24760No exploit	An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.ofcms project · ofcms · CWE-269	High8.8	—	0.8%	Mar 15, 2023
29Monitor	CVE-2019-9616No exploit	An issue was discovered in OFCMS before 1.1.3.ofcms project · ofcms · CWE-706 RCE	High7.2	—	2.7%	Mar 6, 2019
29Monitor	CVE-2019-9613No exploit	An issue was discovered in OFCMS before 1.1.3.ofcms project · ofcms · CWE-434 RCE File upload	High7.2	—	2.7%	Mar 6, 2019
28Monitor	CVE-2019-9615No exploit	An issue was discovered in OFCMS before 1.1.3.ofcms project · ofcms · CWE-89 SQL injection	High7.2	—	1.3%	Mar 6, 2019
26Monitor	CVE-2019-9611No exploit	An issue was discovered in OFCMS before 1.1.3.ofcms project · ofcms · CWE-22 Path traversal	Medium6.5	—	1.4%	Mar 6, 2019
26Monitor	CVE-2024-48235No exploit	An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file.ofcms project · ofcms · CWE-94 RCE	Medium6.5	—	0.7%	Oct 25, 2024
26Monitor	CVE-2024-48236No exploit	An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of tofcms project · ofcms · CWE-94 RCE	Medium6.5	—	0.7%	Oct 25, 2024
24Monitor	CVE-2022-29653No exploit	OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json.ofcms project · ofcms · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	Jun 2, 2022
21Monitor	CVE-2022-27960No exploit	Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarilofcms project · ofcms · CWE-276	Medium5.4	—	0.5%	Apr 10, 2022
21Monitor	CVE-2023-51807No exploit	Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the titofcms project · ofcms · CWE-79 XSS	Medium5.4	—	0.5%	Jan 16, 2024
21Monitor	CVE-2022-27961No exploit	A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML ofcms project · ofcms · CWE-79 RCE XSS	Medium5.4	—	0.4%	Apr 10, 2022
21Monitor	CVE-2024-9411No exploit	OFCMS add.json add cross site scriptingofcms project · ofcms · CWE-79 XSS	Medium5.3	—	0.4%	Oct 1, 2024
21Monitor	CVE-2025-1557No exploit	OFCMS cross-site request forgeryofcms project · ofcms · CWE-352 Pre-auth CSRF	Medium5.3	—	0.3%	Feb 22, 2025
17Monitor	CVE-2019-9610No exploit	An issue was discovered in OFCMS before 1.1.3.ofcms project · ofcms · CWE-22 Path traversal	Medium4.3	—	1.4%	Mar 6, 2019

CVE-2024-34256
39Monitor
OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
ofcms project · ofcmsMay 14, 2024
CVE-2019-9617
36Monitor
An issue was discovered in OFCMS before 1.1.3.
HighCVSS 8.8No exploitEPSS 3%
- RCE
- File upload
ofcms project · ofcmsMar 6, 2019
CVE-2019-9609
36Monitor
An issue was discovered in OFCMS before 1.1.3.
HighCVSS 8.8No exploitEPSS 3%
- RCE
- File upload
ofcms project · ofcmsMar 6, 2019
CVE-2019-9608
36Monitor
An issue was discovered in OFCMS before 1.1.3.
HighCVSS 8.8No exploitEPSS 3%
- RCE
- File upload
ofcms project · ofcmsMar 6, 2019
CVE-2019-9612
36Monitor
An issue was discovered in OFCMS before 1.1.3.
HighCVSS 8.8No exploitEPSS 3%
- RCE
- File upload
ofcms project · ofcmsMar 6, 2019
CVE-2019-9614
36Monitor
An issue was discovered in OFCMS before 1.1.3.
HighCVSS 8.8No exploitEPSS 3%
- RCE
ofcms project · ofcmsMar 6, 2019
CVE-2023-24760
35Monitor
An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.
HighCVSS 8.8No exploitEPSS 1%
ofcms project · ofcmsMar 15, 2023
CVE-2019-9616
29Monitor
An issue was discovered in OFCMS before 1.1.3.
HighCVSS 7.2No exploitEPSS 3%
- RCE
ofcms project · ofcmsMar 6, 2019
CVE-2019-9613
29Monitor
An issue was discovered in OFCMS before 1.1.3.
HighCVSS 7.2No exploitEPSS 3%
- RCE
- File upload
ofcms project · ofcmsMar 6, 2019
CVE-2019-9615
28Monitor
An issue was discovered in OFCMS before 1.1.3.
HighCVSS 7.2No exploitEPSS 1%
- SQL injection
ofcms project · ofcmsMar 6, 2019
CVE-2019-9611
26Monitor
An issue was discovered in OFCMS before 1.1.3.
MediumCVSS 6.5No exploitEPSS 1%
- Path traversal
ofcms project · ofcmsMar 6, 2019
CVE-2024-48235
26Monitor
An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file.
MediumCVSS 6.5No exploitEPSS 1%
- RCE
ofcms project · ofcmsOct 25, 2024
CVE-2024-48236
26Monitor
An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of t
MediumCVSS 6.5No exploitEPSS 1%
- RCE
ofcms project · ofcmsOct 25, 2024
CVE-2022-29653
24Monitor
OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
ofcms project · ofcmsJun 2, 2022
CVE-2022-27960
21Monitor
Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitraril
MediumCVSS 5.4No exploitEPSS 0%
ofcms project · ofcmsApr 10, 2022
CVE-2023-51807
21Monitor
Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the tit
MediumCVSS 5.4No exploitEPSS 0%
- XSS
ofcms project · ofcmsJan 16, 2024
CVE-2022-27961
21Monitor
A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML
MediumCVSS 5.4No exploitEPSS 0%
- RCE
- XSS
ofcms project · ofcmsApr 10, 2022
CVE-2024-9411
21Monitor
OFCMS add.json add cross site scripting
MediumCVSS 5.3No exploitEPSS 0%
- XSS
ofcms project · ofcmsOct 1, 2024
CVE-2025-1557
21Monitor
OFCMS cross-site request forgery
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- CSRF
ofcms project · ofcmsFeb 22, 2025
CVE-2019-9610
17Monitor
An issue was discovered in OFCMS before 1.1.3.
MediumCVSS 4.3No exploitEPSS 1%
- Path traversal
ofcms project · ofcmsMar 6, 2019