JizhiCMS vulnerabilities
5 known CVE vulnerabilities in JizhiCMS, translated and rated.
- CVE-2025-25785Critical
JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability in the component \c\PluginsController.php. This allows attackers to perform intranet scanning via a crafted request.
- CVE-2025-25784Critical
An arbitrary file upload vulnerability in Jizhicms v2.5.4 component TemplateController.php allows attackers to execute arbitrary code by uploading a crafted ZIP file.
- CVE-2024-32161Critical
JizhiCMS 2.5 suffers from a file upload vulnerability due to insufficient validation. An attacker can upload a malicious file, potentially leading to remote code execution.
- CVE-2025-70397High
In jizhicms 2.5.6, a SQL injection vulnerability was found in the Article/deleteAll and Extmolds/deleteAll functions via the data parameter. An attacker can inject malicious SQL queries, leading to unauthorized database access.
- CVE-2020-21228Medium
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the /user/release.html component, allowing attackers to arbitrarily add an administrator cookie.