Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition...
5.4CVSS
5.1AI Score
0.001EPSS
An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in...
8.8CVSS
8.6AI Score
0.002EPSS
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/editUploadImage...
8.8CVSS
8.9AI Score
0.003EPSS
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadVideo...
7.2CVSS
7.3AI Score
0.003EPSS
An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with '<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("' followed by the...
8.8CVSS
8.6AI Score
0.001EPSS
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadImage...
8.8CVSS
8.9AI Score
0.003EPSS
An issue was discovered in OFCMS before 1.1.3. It allows admin/system/generate/create?sql= SQL injection, related to...
7.2CVSS
7.1AI Score
0.001EPSS
An issue was discovered in OFCMS before 1.1.3. It has admin/cms/template/getTemplates.html?res_path=res&up_dir=../ directory traversal, related to the getTemplates function in...
4.3CVSS
4.6AI Score
0.001EPSS
An issue was discovered in OFCMS before 1.1.3. It allows admin/cms/template/getTemplates.html?res_path=res directory traversal, with ../ in the dir parameter, to write arbitrary content (in the file_content parameter) into an arbitrary file (specified by the file_name parameter). This is related...
6.5CVSS
6.5AI Score
0.001EPSS
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/upload...
8.8CVSS
8.9AI Score
0.003EPSS
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadFile...
8.8CVSS
8.9AI Score
0.003EPSS
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadScrawl...
7.2CVSS
7.3AI Score
0.003EPSS
OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component...
6.1CVSS
6AI Score
0.001EPSS
A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment text...
5.4CVSS
5.3AI Score
0.001EPSS
Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' personal...
5.4CVSS
5.5AI Score
0.001EPSS