ujcms 6.0.2 vulnerabilities
4 known CVE vulnerabilities in ujcms 6.0.2, translated and rated.
- CVE-2023-34865Critical
CVE-2023-34865 in ujcms 6.0.2 has a directory traversal vulnerability that allows attackers to move files via the rename feature.
- CVE-2023-34747Critical
There is a file upload vulnerability in ujcms version 6.0.2 via the endpoint /api/backend/core/web-file-upload/upload.
- CVE-2026-78140Medium
A vulnerability in Dromara UJCMS up to 10.1.3 in the update function of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the web-file-template Endpoint component. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.
- CVE-2023-34878High
An issue was discovered in Ujcms v6.0.2 that allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip.