PT-2025-14565 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 3.5.0 Description: A critical vulnerability has been found in WonderCMS, affecting the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload...

WonderCMS code-related vulnerabilities

WonderCMS is an open source PHP-based content management system CMS from WonderCMS, Inc. A code issue vulnerability exists in WonderCMS version 3.5.0, which stems from an unrestricted upload issue in the Theme Installation/Plugin Installation component...

CVE-2025-3123: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload. The attack may be launched remotely. The...

Exploit for Cross-site Scripting in Wondercms

CVE-2023-41425 CVE-2023-41425 XSS to RCE, Wonder CMS 3.2.0 &l...

Exploit for Cross-site Scripting in Wondercms

CVE-2023-41425-WonderCMS-Authenticated-RCE Description Won...

Exploit for Cross-site Scripting in Wondercms

CVE-2023-41425 Writing one b...

Exploit for Cross-site Scripting in Wondercms

CVE-2023-41425 Description A Cross Site Scripting vulnerab...

WonderCMS Server-Side Request Forgery Vulnerability

WonderCMS is a PHP-based open source content management system CMS from WonderCMS. A server-side request forgery vulnerability exists in WonderCMS version 3.4.3, which stems from a failure to properly validate user input in the Plugins Page, and can be exploited by an attacker to force the...

CVE-2024-41305

A Server-Side Request Forgery SSRF in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2024-41305

A Server-Side Request Forgery SSRF in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

CVE-2024-41305

A Server-Side Request Forgery (SSRF) vulnerability exists in the Plugins Page of WonderCMS v3.4.3 . The root cause is a failure to properly validate user input, which allows an attacker to inject crafted URLs into the pluginThemeUrl parameter. This enables the attacker to force the application to...

CVE-2024-41305: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

WonderCMS security vulnerabilities

WonderCMS is a PHP-based open source content management system CMS from WonderCMS. A server-side request forgery vulnerability exists in WonderCMS version 3.4.3, which stems from a failure to properly validate user input in the Plugins Page, and can be exploited by an attacker to force the...

CVE-2024-41305

A Server-Side Request Forgery SSRF in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

CVE-2024-41305

A Server-Side Request Forgery SSRF in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

PT-2024-29352 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 3.4.3 Description: A Server-Side Request Forgery SSRF issue in the Plugins Page allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...