Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file.
7.8CVSS
7.8AI Score
0.001EPSS
A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Articles field.
5.4CVSS
5.2AI Score
0.001EPSS
here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.
9.8CVSS
9.4AI Score
0.002EPSS