Baijiacms Project

baijiacms_project

11 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (11)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-33396 1Baijiacms Project 1Baijiacms Mar 20, 2025 Feb 15, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via index.php.
CVE-2022-45942 1Baijiacms Project 1Baijiacms Apr 17, 2025 Dec 20, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.
CVE-2022-38931 1Baijiacms Project 1Baijiacms May 28, 2025 Sep 20, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parame...Show more A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter.Show less
CVE-2022-35150 1Baijiacms Project 1Baijiacms Nov 21, 2024 Aug 22, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Baijicms v4 was discovered to contain an arbitrary file upload vulnerability.
CVE-2020-25873 1Baijiacms Project 1Baijiacms Nov 21, 2024 Oct 29, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A directory traversal vulnerability in the component system/manager/class/web/database.php was discovered in Baijiacms V4 which allows attackers to arbitrarily delete folders on the server via the "id" parameter.
CVE-2019-7568 1Baijiacms Project 1Baijiacms Nov 21, 2024 Feb 7, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request.
CVE-2018-16725 1Baijiacms Project 1Baijiacms Nov 21, 2024 Sep 8, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."
CVE-2018-16724 1Baijiacms Project 1Baijiacms Nov 21, 2024 Sep 8, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request.
CVE-2018-10503 1Baijiacms Project 1Baijiacms Nov 21, 2024 Apr 27, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in index.php in baijiacms V4 v4_1_4_20170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=delet...Show more An issue was discovered in index.php in baijiacms V4 v4_1_4_20170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser.Show less
CVE-2018-10249 1Baijiacms Project 1Baijiacms Nov 21, 2024 Apr 20, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account.
CVE-2018-10219 1Baijiacms Project 1Baijiacms Nov 21, 2024 Apr 19, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request.