Ulicms records

7 published records for vendor ulicms.

Researcher profile

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

7 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
37Monitor	CVE-2023-53914No exploit	UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerabilityulicms · ulicms · CWE-639 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.3	—	0.6%	Dec 17, 2025
37Monitor	CVE-2023-53923No exploit	UliCMS 2023.1 Privilege Escalation via Unauthenticated Admin Account Creationulicms · ulicms · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.5%	Dec 17, 2025
34Monitor	CVE-2023-53924No exploit	UliCMS 2023.1-sniffing-vicuna Remote Code Execution via Avatar Uploadulicms · ulicms · CWE-434 RCE File upload	High8.7	—	0.9%	Dec 17, 2025
25Monitor	CVE-2019-11398Proof of concept	Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTMulicms · ulicms · CWE-79 Pre-auth XSS	Medium6.1	—	3.4%	May 8, 2019
24Monitor	CVE-2020-12704Proof of concept	UliCMS before 2020.2 has PageController stored XSS.ulicms · ulicms · CWE-79 Pre-auth XSS	Medium6.1	—	1.1%	May 7, 2020
24Monitor	CVE-2020-12703No exploit	UliCMS before 2020.2 has XSS during PackageController uninstall.ulicms · ulicms · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	May 7, 2020
20Monitor	CVE-2023-53925No exploit	UliCMS 2023.1 Stored Cross-Site Scripting via SVG File Uploadulicms · ulicms · CWE-79 RCE XSS	Medium5.1	—	0.3%	Dec 17, 2025

CVE-2023-53914
37Monitor
UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
ulicms · ulicmsDec 17, 2025
CVE-2023-53923
37Monitor
UliCMS 2023.1 Privilege Escalation via Unauthenticated Admin Account Creation
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ulicms · ulicmsDec 17, 2025
CVE-2023-53924
34Monitor
UliCMS 2023.1-sniffing-vicuna Remote Code Execution via Avatar Upload
HighCVSS 8.7No exploitEPSS 0%
- RCE
- File upload
ulicms · ulicmsDec 17, 2025
CVE-2019-11398
25Monitor
Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTM
MediumCVSS 6.1Proof of conceptEPSS 3%
- Pre-auth
- XSS
ulicms · ulicmsMay 8, 2019
CVE-2020-12704
24Monitor
UliCMS before 2020.2 has PageController stored XSS.
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
ulicms · ulicmsMay 7, 2020
CVE-2020-12703
24Monitor
UliCMS before 2020.2 has XSS during PackageController uninstall.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
ulicms · ulicmsMay 7, 2020
CVE-2023-53925
20Monitor
UliCMS 2023.1 Stored Cross-Site Scripting via SVG File Upload
MediumCVSS 5.1No exploitEPSS 0%
- RCE
- XSS
ulicms · ulicmsDec 17, 2025