Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

CMS — Vulnerabilities & Security Advisories 321

All 321 CVE vulnerabilities found in CMS, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting Content Management Systems. It collects recorded flaws across multiple CMS vendors, spanning advisories published over the last five years. Readers can track vendor-specific security updates, analyze common weakness classes such as SQL injection and cross-site scripting, and review the historical vulnerability trends for any given product. The data is organized by vendor and weakness type, enabling detailed comparison and trend analysis. No specific CVE identifiers are listed in this overview; the focus remains on patterns, frequencies, and remediation guidance. This resource supports security teams, developers, and IT managers who need to prioritize patches and assess risk exposure across their managed platforms.

Vendor: Mambo

CVE ID Title CVSS Severity Published
CVE-2025-5428 juzaweb CMS Error Logs Page log-viewer access control CWE-284 6.3 Medium 2025-06-02
CVE-2025-5427 juzaweb CMS Permalinks Page permalinks access control CWE-284 6.3 Medium 2025-06-02
CVE-2025-5426 juzaweb CMS Menu Page menus access control CWE-284 6.3 Medium 2025-06-02
CVE-2025-5425 juzaweb CMS Theme Editor Page default access control CWE-284 6.3 Medium 2025-06-02
CVE-2025-5424 juzaweb CMS Media Page media access control CWE-284 6.3 Medium 2025-06-02
CVE-2025-5423 juzaweb CMS General Setting Page general access control CWE-284 6.3 Medium 2025-06-02
CVE-2025-5422 juzaweb CMS Email Logs Page email access control CWE-284 4.3 Medium 2025-06-02
CVE-2025-5421 juzaweb CMS Plugin Editor Page editor access control CWE-284 6.3 Medium 2025-06-02
CVE-2025-5420 juzaweb CMS Profile Page upload cross site scripting CWE-79 3.5 Low 2025-06-02
CVE-2025-5383 Yifang CMS Article Management Module cross site scripting CWE-79 2.4 Low 2025-05-31
CVE-2025-5381 Yifang CMS Admin Panel downloadFile path traversal CWE-22 2.7 Low 2025-05-31
CVE-2025-35939 Craft CMS stores user-provided content in session files CWE-472 5.3 Medium 2025-05-07
CVE-2025-46731 Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI CWE-1336 7.2AI High AI 2025-05-05
CVE-2025-32432 Craft CMS Allows Remote Code Execution CWE-94 10.0 Critical 2025-04-25
CVE-2025-3534 PowerCreator CMS OpenPublicCourse.aspx sql injection CWE-89 6.3 Medium 2025-04-13
CVE-2025-3214 JFinal CMS readTemplate engine.getTemplate path traversal CWE-22 4.3 Medium 2025-04-04
CVE-2025-2878 Kentico CMS Additional Database Installation Wizard install.aspx cross site scripting CWE-79 2.4 Low 2025-03-27
CVE-2025-2220 Odyssey CMS reCAPTCHA odyssey_contact_form.php key management CWE-320 3.3 Low 2025-03-12
CVE-2025-1544 dingfanzu CMS loadShopInfo.php sql injection CWE-89 6.3 Medium 2025-02-21
CVE-2025-23209 Potential RCE with a compromised security key in craft/cms CWE-94 8.1 High 2025-01-18
CVE-2024-13209 Redaxo CMS Structure Management Page index.php cross site scripting CWE-79 2.4 Low 2025-01-09
CVE-2024-47920 Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 7.5 High 2024-12-30
CVE-2024-47919 Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78 9.8 Critical 2024-12-30
CVE-2024-47918 Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) CWE-78 6.1 Medium 2024-12-30
CVE-2024-56145 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms CWE-94 9.8 - 2024-12-18
CVE-2024-52600 Statamic CMS has Path Traversal in Asset Upload CWE-22 5.3 Medium 2024-11-19
CVE-2024-52291 Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution CWE-22 8.5 High 2024-11-13
CVE-2024-52292 Craft Allows Attackers to Read Arbitrary System Files CWE-552 7.7 High 2024-11-13
CVE-2024-52293 Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI CWE-22 7.2 High 2024-11-13
CVE-2024-11175 Public CMS Voting Management save cross site scripting CWE-79 3.5 Low 2024-11-13

All 321 known CVE vulnerabilities affecting CMS with full Chinese analysis, references, and POCs where available.