Skip to content
Noroxi

ujcms records

20 published records for vendor ujcms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 22
  2. 23
  3. 24
  4. 25
  5. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

20 records
  • CVE-2023-34747
    45Plan

    File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.

    CriticalCVSS 9.8No exploitEPSS 20%

    ujcms · ujcmsJun 14, 2023

  • CVE-2022-23329
    43Plan

    A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via

    CriticalCVSS 9.8No exploitEPSS 14%

    ujcms · jspxcmsFeb 4, 2022

  • CVE-2023-51350
    39Monitor

    A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script

    CriticalCVSS 9.8No exploitEPSS 1%

    ujcms · ujcmsJan 11, 2024

  • CVE-2023-34865
    39Monitor

    Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.

    CriticalCVSS 9.8No exploitEPSS 1%

    ujcms · ujcmsJun 14, 2023

  • CVE-2023-34878
    30Monitor

    An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-h

    HighCVSS 7.5No exploitEPSS 1%

    ujcms · ujcmsJun 14, 2023

  • CVE-2024-12483
    26Monitor

    Dromara UJCMS User ID id authorization

    MediumCVSS 6.3Proof of conceptEPSS 4%

    ujcms · ujcmsDec 11, 2024

  • CVE-2022-28090
    26Monitor

    Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=.

    MediumCVSS 6.5No exploitEPSS 1%

    ujcms · jspxcmsMay 4, 2022

  • CVE-2023-3231
    26Monitor

    UJCMS ZIP Package information disclosure

    MediumCVSS 6.5No exploitEPSS 1%

    ujcms · ujcmsJun 14, 2023

  • CVE-2024-1257
    24Monitor

    Jspxcms find_text.do cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    ujcms · jspxcmsFeb 6, 2024

  • CVE-2023-24369
    24Monitor

    A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted

    MediumCVSS 6.1No exploitEPSS 0%

    ujcms · ujcmsFeb 17, 2023

  • CVE-2023-51806
    21Monitor

    File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.

    MediumCVSS 5.4No exploitEPSS 1%

    ujcms · ujcmsJan 12, 2024

  • CVE-2024-0599
    21Monitor

    Jspxcms Document Management Page InfoController.java cross site scripting

    MediumCVSS 5.4No exploitEPSS 1%

    ujcms · jspxcmsJan 16, 2024

  • CVE-2024-55452
    21Monitor

    A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel

    MediumCVSS 5.4No exploitEPSS 0%

    ujcms · ujcmsDec 16, 2024

  • CVE-2025-25772
    20Monitor

    A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add A

    MediumCVSS 5.1No exploitEPSS 0%

    ujcms · jspxcmsFeb 21, 2025

  • CVE-2025-2491
    19Monitor

    Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting

    MediumCVSS 4.8No exploitEPSS 0%

    ujcms · ujcmsMar 18, 2025

  • CVE-2025-2490
    19Monitor

    Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting

    MediumCVSS 4.8No exploitEPSS 0%

    ujcms · ujcmsMar 18, 2025

  • CVE-2024-55451
    19Monitor

    A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3.

    MediumCVSS 4.8No exploitEPSS 0%

    ujcms · ujcmsDec 16, 2024

  • CVE-2024-1256
    17Monitor

    Jspxcms filter_text.do cross site scripting

    MediumCVSS 4.3No exploitEPSS 1%

    ujcms · jspxcmsFeb 6, 2024

  • CVE-2026-2953
    8Monitor

    Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal

    LowCVSS 2.1No exploitEPSS 1%

    ujcms · ujcmsFeb 22, 2026

  • CVE-2026-2954
    8Monitor

    Dromara UJCMS ImportDataController import-channel importChanel injection

    LowCVSS 2.1No exploitEPSS 1%

    ujcms · ujcmsFeb 22, 2026