CVE-2022-29309

CVE-2022-29309 affects mysiteforme v2.2.1 and is a Server-Side Request Forgery (SSRF). Evidence from PT-2022-19532 indicates the issue is related to SSRF in version 2.2.1 and currently there is no available fix/version documented. Other sources (CNNVD) describe the vulnerability as enabling spoof...

CVE-2024-57764

MSFM prior to 2025-01-01 contains a fastjson deserialization vulnerability in the system/table/add component. CVSS v3.1 base score 9.1 (CRITICAL); attack vector: NETWORK, authentication: NONE, user interaction: NONE, privileges required: NONE, scope: UNCHANGED; impacts: confidentiality and integr...

CVE-2024-57765

MSFM is affected by a SQL injection in the s_name parameter exposed at the table/list endpoint, with versions prior to 2025.01.01 vulnerable. Exploitation could allow execution of arbitrary SQL and theft of sensitive data (per CNVD/CNNVD). Remediation details are not uniformly provided across sou...

CVE-2021-46026

CVE-2021-46026 affects the Mysiteforme system (permission management). The vulnerability is a Cross Site Scripting (XSS) flaw in the backend blog management’s article/blog tag function, stemming from insufficient validation of user-supplied data in the tag workflow. Impact: client-side JavaScript...

CVE-2024-57763

MSFM before 2025-01-01 contains a fastjson deserialization vulnerability in the component system/table/addField. The CVE-2024-57763 entry identifies high-impact risks to confidentiality and integrity (CVSS 9.1, Network attack, no privileges, no user interaction). Available connected sources indic...

CVE-2024-13138

CVE-2024-13138 affects wangl1989 mysiteforme 1.0, specifically the file upload logic in LocalUploadServiceImpl (src/main/java/com/mysiteform/admin/service/ipl/LocalUploadServiceImpl). The root cause is manipulation of the argument named test, enabling unrestricted file upload. The issue is exploi...

CVE-2021-46027

CVE-2021-46027 concerns a CSRF vulnerability in the background blog management of mysiteforme . The description across sources states an attacker can craft a malicious link and, when a site administrator clicks it, a blog tag is added, indicating a cross-site request forgery in the backend admini...

CVE-2024-57766

CVE-2024-57766 affects MSFM prior to 2025-01-01, with a fastjson deserialization vulnerability in the component system/table/editField. The CVSS v3.1 base score is 9.1 (CRITICAL): Network attack, no user interaction, no privileges required, with high confidentiality and integrity impact. Document...

CVE-2024-57762

MSFM prior to 2025.01.01 is affected by a deserialization vulnerability via the pom.xml configuration file (CVE-2024-57762). The issue is documented across multiple sources, with the recommended fix to upgrade to version 2025.01.01 or later; a temporary mitigation is to restrict access to the pom...

CVE-2024-57767

CVE-2024-57767 affects MSFM prior to 2025.01.01 and describes a Server-Side Request Forgery (SSRF) via the "/file/download" component. The root cause is an SSRF vulnerability in the file-download functionality, enabling an attacker to access internal resources through the affected module. The CVS...

CVE-2025-26136

CVE-2025-26136 is a SQL injection vulnerability in mysiteforme versions prior to 2025.01.1. The NVD entry shows a CVSS 3.1 base score of 9.8 (CRITICAL) with NETWORK attack vector, LOW attack complexity, no privileges, and no user interaction required, affecting confidentiality, integrity, and ava...

CVE-2024-13137

CVE-2024-13137 affects wangl1989 mysitforme 1.0, specifically the RestResponse function in src/main/java/com/mysiteforme/admin/controller/system/SiteController. The manipulation enables cross-site scripting and can be triggered remotely. The vulnerability is publicly disclosed and may be exploite...

CVE-2024-13136

Summary (CVE-2024-13136): A deserialization vulnerability affecting the RememberMeManager in wangl1989 mysiteforme 1.0, located at src/main/java/com/mysiteforme/admin/config/ShiroConfig.java. The issue is triggered via the RememberMeManager component and can be exploited remotely. The exploit has...

CVE-2024-13139

CVE-2024-13139 affects the Java application “mysiteforme” 1.0. The issue is in the function doContent of the file src/main/java/com/mysiteform/admin/controller/system/FileController , where manipulation of the argument content enables server-side request forgery (SSRF). The vulnerability can be t...