CVE-2019-9608

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadImage URI...

CVE-2025-1557

CVE-2025-1557 concerns OFCMS 1.1.3 where an unknown function allows cross-site request forgery (CSRF). The manipulation enables a remote attacker to exploit the vulnerability, with the exploit publicly disclosed. Multiple connected sources consistently identify CSRF as the impact vector and OFCMS...

CVE-2025-1557 OFCMS cross-site request forgery

A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used...

PT-2025-7531 · Ofcms · Ofcms

Name of the Vulnerable Software and Affected Versions: OFCMS version 1.1.3 Description: A vulnerability was found in OFCMS, which can be exploited to perform cross-site request forgery. The issue is related to an unknown function and can be launched remotely. The exploit has been disclosed to the...

OFCMS cross-site scripting vulnerability (CNVD-2024-41671)

OFSoft OFCMS is a content management system CMS developed by China Zhongtian Network OFSoft using Java language. OFCMS version 1.1.2 cross-site scripting vulnerability, the vulnerability stems from the file /admin/system/dict/add.json?sqlid=system.dict.save parameter dictvalue on the user-supplie...

CVE-2024-34256

OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function...

PT-2023-19768 · Ofcms · Ofcms

Name of the Vulnerable Software and Affected Versions: Ofcms version 1.1.4 Description: An issue in Ofcms allows a remote attacker to escalate privileges via the respwd method in SysUserController. Recommendations: For Ofcms version 1.1.4, consider disabling the respwd method in SysUserController...

OFCMS 跨站脚本漏洞

OFCMS is a content management system CMS developed by China Zhongtian Network Technology Company using Java language. v1.1.4 of OFCMS has a cross-site scripting vulnerability, which originates from the component /admin/comn/service/update.json lack of data validation filtering for user-supplied...