Skip to content
Noroxi

ucms project records

28 published records for vendor ucms project.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
0%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

28 records
  • CVE-2020-25483
    42Plan

    An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access

    CriticalCVSS 9.8No exploitEPSS 8%

    ucms project · ucmsOct 23, 2020

  • CVE-2020-25537
    40Plan

    File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permis

    CriticalCVSS 9.8No exploitEPSS 1%

    ucms project · ucmsNov 30, 2020

  • CVE-2018-17036
    39Monitor

    An issue was discovered in UCMS 1.4.6 and 1.6.

    CriticalCVSS 9.8No exploitEPSS 1%

    ucms project · ucmsSep 14, 2018

  • CVE-2022-38297
    39Monitor

    UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.

    CriticalCVSS 9.8No exploitEPSS 1%

    ucms project · ucmsSep 12, 2022

  • CVE-2018-17035
    39Monitor

    UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    ucms project · ucmsSep 14, 2018

  • CVE-2022-35426
    39Monitor

    UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file.

    CriticalCVSS 9.8No exploitEPSS 1%

    ucms project · ucmsAug 10, 2022

  • CVE-2023-1303
    39Monitor

    UCMS System File Management Module fileedit.php unrestricted upload

    CriticalCVSS 9.8No exploitEPSS 0%

    ucms project · ucmsMar 9, 2023

  • CVE-2022-28440
    36Monitor

    An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file.

    HighCVSS 8.8No exploitEPSS 1%

    ucms project · ucmsApr 21, 2022

  • CVE-2022-28443
    36Monitor

    UCMS v1.6 was discovered to contain an arbitrary file deletion vulnerability.

    CriticalCVSS 9.1No exploitEPSS 0%

    ucms project · ucmsApr 21, 2022

  • CVE-2018-20599
    35Monitor

    UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action.

    HighCVSS 8.8No exploitEPSS 1%

    ucms project · ucmsDec 30, 2018

  • CVE-2019-12251
    35Monitor

    sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter.

    HighCVSS 8.8No exploitEPSS 1%

    ucms project · ucmsMay 21, 2019

  • CVE-2018-19437
    35Monitor

    UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrar

    HighCVSS 8.8No exploitEPSS 1%

    ucms project · ucmsNov 22, 2018

  • CVE-2022-42234
    35Monitor

    There is a file inclusion vulnerability in the template management module in UCMS 1.6

    HighCVSS 8.8No exploitEPSS 0%

    ucms project · ucmsOct 14, 2022

  • CVE-2018-17037
    35Monitor

    user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3.

    HighCVSS 8.8No exploitEPSS 0%

    ucms project · ucmsSep 14, 2018

  • CVE-2018-20598
    35Monitor

    UCMS 1.4.7 has ?do=user_addpost CSRF.

    HighCVSS 8.8No exploitEPSS 0%

    ucms project · ucmsDec 30, 2018

  • CVE-2022-28444
    30Monitor

    UCMS v1.6 was discovered to contain an arbitrary file read vulnerability.

    HighCVSS 7.5No exploitEPSS 1%

    ucms project · ucmsApr 21, 2022

  • CVE-2018-16804
    24Monitor

    An issue was discovered in UCMS 1.4.6.

    MediumCVSS 6.1No exploitEPSS 0%

    ucms project · ucmsMar 7, 2019

  • CVE-2018-20600
    24Monitor

    sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.

    MediumCVSS 6.1No exploitEPSS 0%

    ucms project · ucmsDec 30, 2018

  • CVE-2018-17034
    24Monitor

    UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter.

    MediumCVSS 6.1No exploitEPSS 0%

    ucms project · ucmsSep 14, 2018

  • CVE-2018-17320
    24Monitor

    An issue was discovered in UCMS 1.4.6.

    MediumCVSS 6.1No exploitEPSS 0%

    ucms project · ucmsSep 21, 2018

  • CVE-2022-38527
    24Monitor

    UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page.

    MediumCVSS 6.1No exploitEPSS 0%

    ucms project · ucmsSep 19, 2022

  • CVE-2023-2294
    24Monitor

    UCMS Column Configuration saddpost.php cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    ucms project · ucmsApr 26, 2023

  • CVE-2023-5015
    24Monitor

    UCMS cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    ucms project · ucmsSep 16, 2023

  • CVE-2020-24981
    21Monitor

    An Incorrect Access Control vulnerability exists in /ucms/chk.php in UCMS 1.4.8.

    MediumCVSS 5.3No exploitEPSS 0%

    ucms project · ucmsSep 4, 2020

  • CVE-2021-25809
    21Monitor

    UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php.

    MediumCVSS 5.3No exploitEPSS 0%

    ucms project · ucmsJul 23, 2021