tpcms project records
5 published records for vendor tpcms project.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-532 Insertion of Sensitive Information into Log File2
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-434 Unrestricted Upload of File with Dangerous Type1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
35Monitor | CVE-2022-29624No exploit | An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP ftpcms project · tpcms · CWE-434 | High8.8 | 1.3%Jun 2, 2022 |
30Monitor | CVE-2022-27442No exploit | TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and tpcms project · tpcms · CWE-532 | High7.5 | 0.9%Apr 4, 2022 |
30Monitor | CVE-2021-36544No exploit | Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL.tpcms project · tpcms · CWE-532 | High7.5 | 0.9%Feb 3, 2023 |
21Monitor | CVE-2021-36545No exploit | Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field itpcms project · tpcms · CWE-79 | Medium5.4 | 0.5%Feb 3, 2023 |
19Monitor | CVE-2022-27441No exploit | A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payltpcms project · tpcms · CWE-79 | Medium4.8 | 0.4%Apr 4, 2022 |
- CVE-2022-2962435Monitor
An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP f
HighCVSS 8.8No exploitEPSS 1%tpcms project · tpcmsJun 2, 2022
- CVE-2022-2744230Monitor
TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and
HighCVSS 7.5No exploitEPSS 0%tpcms project · tpcmsApr 4, 2022
- CVE-2021-3654430Monitor
Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL.
HighCVSS 7.5No exploitEPSS 0%tpcms project · tpcmsFeb 3, 2023
- CVE-2021-3654521Monitor
Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field i
MediumCVSS 5.4No exploitEPSS 0%tpcms project · tpcmsFeb 3, 2023
- CVE-2022-2744119Monitor
A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payl
MediumCVSS 4.8No exploitEPSS 0%tpcms project · tpcmsApr 4, 2022