Skip to content
Noroxi

publiccms records

47 published records for vendor publiccms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
8
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 21
  3. 22
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

47 records
  • CVE-2022-23389
    46Plan

    PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.

    CriticalCVSS 9.8No exploitEPSS 22%

    publiccms · publiccmsFeb 14, 2022

  • CVE-2018-12914
    40Plan

    A remote code execution issue was discovered in PublicCMS V4.0.20180210.

    CriticalCVSS 9.8No exploitEPSS 4%

    publiccms · publiccmsJun 27, 2018

  • CVE-2021-40881
    39Monitor

    An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.

    CriticalCVSS 9.8No exploitEPSS 2%

    publiccms · publiccmsSep 15, 2021

  • CVE-2023-46990
    39Monitor

    Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the

    CriticalCVSS 9.8No exploitEPSS 1%

    publiccms · publiccmsNov 20, 2023

  • CVE-2020-20914
    39Monitor

    SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    publiccms · publiccmsApr 4, 2023

  • CVE-2020-20915
    39Monitor

    SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSite

    CriticalCVSS 9.8No exploitEPSS 1%

    publiccms · publiccmsApr 4, 2023

  • CVE-2021-27693
    39Monitor

    Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage

    CriticalCVSS 9.8No exploitEPSS 1%

    publiccms · publiccmsSep 2, 2022

  • CVE-2023-34852
    39Monitor

    PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    publiccms · publiccmsJun 15, 2023

  • CVE-2025-25361
    39Monitor

    An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to exe

    CriticalCVSS 9.8No exploitEPSS 1%

    publiccms · publiccmsMar 6, 2025

  • CVE-2025-65836
    36Monitor

    PublicCMS V5.202506.b is vulnerable to SSRF.

    CriticalCVSS 9.1No exploitEPSS 0%

    publiccms · publiccmsDec 1, 2025

  • CVE-2024-40550
    35Monitor

    An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers t

    HighCVSS 8.8No exploitEPSS 1%

    publiccms · publiccmsJul 12, 2024

  • CVE-2024-31759
    35Monitor

    An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.

    HighCVSS 8.8No exploitEPSS 1%

    publiccms · publiccmsApr 16, 2024

  • CVE-2024-40546
    35Monitor

    An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitr

    HighCVSS 8.8No exploitEPSS 1%

    publiccms · publiccmsJul 12, 2024

  • CVE-2024-40552
    35Monitor

    PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/Script

    HighCVSS 8.8No exploitEPSS 1%

    publiccms · publiccmsJul 12, 2024

  • CVE-2024-40548
    35Monitor

    An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbit

    HighCVSS 8.8No exploitEPSS 1%

    publiccms · publiccmsJul 12, 2024

  • CVE-2024-40549
    35Monitor

    An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute

    HighCVSS 8.8No exploitEPSS 1%

    publiccms · publiccmsJul 12, 2024

  • CVE-2024-40545
    35Monitor

    An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute ar

    HighCVSS 8.8No exploitEPSS 1%

    publiccms · publiccmsJul 12, 2024

  • CVE-2018-11500
    35Monitor

    An issue was discovered in PublicCMS V4.0.20180210.

    HighCVSS 8.8No exploitEPSS 1%

    publiccms · publiccmsMay 26, 2018

  • CVE-2024-40544
    35Monitor

    PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit.

    HighCVSS 8.8No exploitEPSS 0%

    publiccms · publiccmsJul 12, 2024

  • CVE-2024-40551
    35Monitor

    An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute a

    HighCVSS 8.8No exploitEPSS 0%

    publiccms · publiccmsJul 12, 2024

  • CVE-2024-40543
    35Monitor

    PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage.

    HighCVSS 8.8No exploitEPSS 0%

    publiccms · publiccmsJul 12, 2024

  • CVE-2025-65840
    35Monitor

    PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.

    HighCVSS 8.8No exploitEPSS 0%

    publiccms · publiccmsDec 1, 2025

  • CVE-2025-69437
    34Monitor

    PublicCMS v5.202506.d and earlier is vulnerable to stored XSS.

    HighCVSS 8.7No exploitEPSS 0%

    publiccms · publiccmsFeb 27, 2026

  • CVE-2025-57516
    32Monitor

    OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary com

    HighCVSS 8.2No exploitEPSS 1%

    publiccms · publiccmsSep 29, 2025

  • CVE-2025-65838
    30Monitor

    PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.

    HighCVSS 7.5No exploitEPSS 0%

    publiccms · publiccmsDec 1, 2025