CVE-2024-12481

The CVE-2024-12481 issue affects cjbi wetech-cms versions 1.0–1.2, specifically the findUser function in UserDao.java. The root cause is improper handling of arguments (searchValue, gId, rId) leading to SQL injection. Exploitation is possible remotely, and disclosures/Public exploits are noted. T...

CVE-2024-12482

CVE-2024-12482 affects cjbi wetech-cms versions 1.0–1.2, specifically the Database Backup Handler’s BackupFileUtil.java. The root cause is a path traversal vulnerability caused by manipulation of the backup function argument name (example: '../filedir'). The vulnerability can be triggered remotel...

CVE-2024-12480

CVE-2024-12480 affects cjbi wetech-cms versions 1.0–1.2. The vulnerable component is the searchTopic function in TopicDao.java (wetech-core). The issue arises from manipulation of the con argument, enabling SQL injection with remote access. Public exploitation has been disclosed; the vendor did n...

CVE-2024-12479

The CVE-2024-12479 issue affects cjbi wetech-cms versions 1.0–1.2, specifically the searchTopicByKeyword function in wetech-cms-master/wetech-core/src/main/java/tech/wetech/cms/dao/TopicDao.java. The root cause is manipulation of the keyword argument leading to SQL injection, with remote initiati...