CVE-2022-25582

CVE-2022-25582 describes a stored cross-site scripting (XSS) vulnerability in the ClassCMS Column module, affecting v2.5 and earlier. The root cause is insufficient validation/filtering of user-supplied data in the Add Articles field, allowing an attacker to inject arbitrary script or HTML that i...

CVE-2022-45966

CVE-2022-45966 affects ClassCMS 3.5, describing an arbitrary file upload vulnerability in the file management function/module. The issue is rooted in the file upload handling (improper validation/verification) and is rated CVSSv3.1 9.8 (Network, High privileges not required, no user interaction) ...