CVE-2025-0708

CVE-2025-0708 affects fumiao opencms 2.2. The vulnerability is in the /admin/model/addOrUpdate endpoint, where manipulating the parameter 模板前缀 can trigger cross-site scripting. Exploitation is possible remotely and publicly disclosed. Connected sources confirm the affected component and the root ...

CVE-2025-3317

Fumiao Opencms (up to commit a0fafa5cff58719e9b27c2a2eec204cc165ce14f) contains a path traversal vulnerability in opencms-dev/src/main/webapp/view/admin/document/dataPage.jsp. The path parameter manipulation allows remote exploitation. No affected version details or fixes are provided in the docu...

CVE-2025-28099

opencms V2.3 is vulnerable to an Arbitrary file read flaw located in the src/main/webapp/view/admin/document/dataPage.jsp file. The root cause is characterized as an Improper Limitation of a Pathname to a Restricted Directory (CWE-22 ). This vulnerability allows an attacker to read files on the s...