PT-2026-97033

Name of the Vulnerable Software and Affected Versions WuzhiCMS version 5.0.0 Description An unrestricted file upload issue exists in the thumbnail-upload endpoint '/index.php?m=member&f=article&v=thumbUpload'. An authenticated low-privileged member can upload a crafted .php file to execute...

CVE-2026-94102 WuzhiCMS Login index.php redirect

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The...

PT-2026-96021

Name of the Vulnerable Software and Affected Versions WuzhiCMS versions prior to 4.1.1 Description A flaw in the Login component allows for an open redirect, which occurs when a user is unexpectedly redirected to an external site. This issue is triggered by the manipulation of the forward argumen...

CVE-2018-17425: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...

CVE-2018-10391: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI...

CVE-2018-10313: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq10%5D parameter to the /index.php?m=member&f=index&v=profile&setiframe=1 URI...

CVE-2018-9927: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add...