CVE-2020-21238

An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.

CVE-2020-22848

A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands.