Tianti Project

tianti_project

10 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (10)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-9795 1Tianti Project 1Tianti Apr 29, 2026 Sep 1, 2025 2.1 LOW· v4 5.4 MEDIUM· v3 6.5 MEDIUM· v2 A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/controller/UploadController.java. The manipulation of the argume...Show more A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/controller/UploadController.java. The manipulation of the argument upfile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2025-8807 1Tianti Project 1Tianti Apr 29, 2026 Aug 10, 2025 2.1 LOW· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been declared as critical. This vulnerability affects unknown code of the file /tianti-module-admin/user/ajax/save. The manipulation leads to missing author...Show more A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been declared as critical. This vulnerability affects unknown code of the file /tianti-module-admin/user/ajax/save. The manipulation leads to missing authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2025-27910 1Tianti Project 1Tianti May 21, 2025 Mar 10, 2025 N/A· v4 8.0 HIGH· v3 N/A· v2 tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.
CVE-2025-25908 1Tianti Project 1Tianti Jun 23, 2025 Mar 10, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save.
CVE-2025-25907 1Tianti Project 1Tianti May 21, 2025 Mar 10, 2025 N/A· v4 8.8 HIGH· v3 N/A· v2 tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.
CVE-2018-19110 1Tianti Project 1Tianti Nov 21, 2024 Nov 8, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a...Show more The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a /skin/list request to the function skinList, and lacks an authorization check.Show less
CVE-2018-19109 1Tianti Project 1Tianti Nov 21, 2024 Nov 8, 2018 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/cms/column/list directly to read the column list page or edit a column.
CVE-2018-19091 1Tianti Project 1Tianti Nov 21, 2024 Nov 7, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter.
CVE-2018-19090 1Tianti Project 1Tianti Nov 21, 2024 Nov 7, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 tianti 2.3 has stored XSS in the article management module via an article title.
CVE-2018-19089 1Tianti Project 1Tianti Nov 21, 2024 Nov 7, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/save_role name parameter, which is mishandled in tianti-module-admin\src\main\webapp\WEB-INF\views\user\user_list.jsp.