wcms records

17 published records for vendor wcms.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 2
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

17 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
45Plan	CVE-2023-31689No exploit	In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parwcms · wcms · CWE-434 pre-auth RCE File upload	Critical9.8	—	20.2%	May 22, 2023
40Plan	CVE-2020-19902No exploit	Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code via the wex/cssjs.php wcms · wcms · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	1.9%	Jun 27, 2023
36Monitor	CVE-2019-11377No exploit	wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension awcms · wcms · CWE-434 File upload	High8.8	—	1.7%	Apr 20, 2019
35Monitor	CVE-2020-24136No exploit	Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename pwcms · wcms · CWE-22 Pre-auth Path traversal	High8.6	—	2.2%	Apr 7, 2021
33Monitor	CVE-2020-24140No exploit	Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application viawcms · wcms · CWE-918 Pre-auth SSRF	High8.3	—	1.2%	Apr 7, 2021
33Monitor	CVE-2020-24139No exploit	Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application viwcms · wcms · CWE-918 Pre-auth SSRF	High8.3	—	1.1%	Apr 7, 2021
32Monitor	CVE-2019-14240No exploit	WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URwcms · wcms · CWE-22 Pre-auth Path traversal CSRF	High8.1	—	0.8%	Jul 23, 2019
27Monitor	CVE-2025-3800No exploit	WCMS AnonymousController.php sql injectionwcms · wcms · CWE-74 Pre-auth SQL injection	Medium6.9	—	0.6%	Apr 19, 2025
27Monitor	CVE-2025-3799No exploit	WCMS AnonymousController.php sql injectionwcms · wcms · CWE-74 Pre-auth SQL injection	Medium6.9	—	0.5%	Apr 19, 2025
25Monitor	CVE-2025-5149No exploit	WCMS Login getallcon getMemberByUid improper authenticationwcms · wcms · CWE-287 Pre-auth Auth bypass	Medium6.3	—	0.6%	May 25, 2025
24Monitor	CVE-2020-24138No exploit	Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parawcms · wcms · CWE-79 Pre-auth XSS	Medium6.1	—	0.9%	Apr 7, 2021
24Monitor	CVE-2020-24135No exploit	A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web scrwcms · wcms · CWE-79 Pre-auth XSS	Medium6.1	—	0.9%	Apr 7, 2021
21Monitor	CVE-2020-24137No exploit	Directory traversal vulnerability in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via wcms · wcms · CWE-22 Pre-auth Path traversal	Medium5.3	—	1.4%	Apr 7, 2021
21Monitor	CVE-2024-8875No exploit	vedees wcms finder.php path traversalwcms · wcms · CWE-22 Path traversal	Medium5.3	—	0.9%	Sep 15, 2024
21Monitor	CVE-2025-2978No exploit	WCMS Article Publishing Page CKEditor unrestricted uploadwcms · wcms · CWE-284 File upload Broken access control (IDOR)	Medium5.3	—	0.5%	Mar 31, 2025
20Monitor	CVE-2025-3798No exploit	WCMS Advertisement Image AdvadminController.php sub unrestricted uploadwcms · wcms · CWE-284 File upload Broken access control (IDOR)	Medium5.1	—	0.5%	Apr 19, 2025
19Monitor	CVE-2025-2979No exploit	WCMS Registration setregister cross site scriptingwcms · wcms · CWE-79 XSS	Medium4.8	—	0.4%	Mar 31, 2025

CVE-2023-31689
45Plan
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish par
CriticalCVSS 9.8No exploitEPSS 20%
- pre-auth RCE
- File upload
wcms · wcmsMay 22, 2023
CVE-2020-19902
40Plan
Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code via the wex/cssjs.php
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Path traversal
wcms · wcmsJun 27, 2023
CVE-2019-11377
36Monitor
wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension a
HighCVSS 8.8No exploitEPSS 2%
- File upload
wcms · wcmsApr 20, 2019
CVE-2020-24136
35Monitor
Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename p
HighCVSS 8.6No exploitEPSS 2%
- Pre-auth
- Path traversal
wcms · wcmsApr 7, 2021
CVE-2020-24140
33Monitor
Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via
HighCVSS 8.3No exploitEPSS 1%
- Pre-auth
- SSRF
wcms · wcmsApr 7, 2021
CVE-2020-24139
33Monitor
Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application vi
HighCVSS 8.3No exploitEPSS 1%
- Pre-auth
- SSRF
wcms · wcmsApr 7, 2021
CVE-2019-14240
32Monitor
WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html UR
HighCVSS 8.1No exploitEPSS 1%
wcms · wcmsJul 23, 2019
CVE-2025-3800
27Monitor
WCMS AnonymousController.php sql injection
MediumCVSS 6.9No exploitEPSS 1%
- Pre-auth
- SQL injection
wcms · wcmsApr 19, 2025
CVE-2025-3799
27Monitor
WCMS AnonymousController.php sql injection
MediumCVSS 6.9No exploitEPSS 1%
- Pre-auth
- SQL injection
wcms · wcmsApr 19, 2025
CVE-2025-5149
25Monitor
WCMS Login getallcon getMemberByUid improper authentication
MediumCVSS 6.3No exploitEPSS 1%
- Pre-auth
- Auth bypass
wcms · wcmsMay 25, 2025
CVE-2020-24138
24Monitor
Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename para
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
wcms · wcmsApr 7, 2021
CVE-2020-24135
24Monitor
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web scr
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
wcms · wcmsApr 7, 2021
CVE-2020-24137
21Monitor
Directory traversal vulnerability in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Path traversal
wcms · wcmsApr 7, 2021
CVE-2024-8875
21Monitor
vedees wcms finder.php path traversal
MediumCVSS 5.3No exploitEPSS 1%
- Path traversal
wcms · wcmsSep 15, 2024
CVE-2025-2978
21Monitor
WCMS Article Publishing Page CKEditor unrestricted upload
MediumCVSS 5.3No exploitEPSS 1%
- File upload
- Broken access control (IDOR)
wcms · wcmsMar 31, 2025
CVE-2025-3798
20Monitor
WCMS Advertisement Image AdvadminController.php sub unrestricted upload
MediumCVSS 5.1No exploitEPSS 0%
- File upload
- Broken access control (IDOR)
wcms · wcmsApr 19, 2025
CVE-2025-2979
19Monitor
WCMS Registration setregister cross site scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
wcms · wcmsMar 31, 2025