Wondercms Security Vulnerabilities and Issues — Wondercms CVE List

Lucene search

WondercmsWondercms

5 matches found

CVE•added 2019/09/12 5:15 p.m.•113 views

CVE-2019-5956

Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors.

7.5CVSS6.4AI score0.00291EPSS

CVE•added 2018/01/26 8:29 p.m.•50 views

CVE-2017-14523

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack

7.5CVSS7.5AI score0.11226EPSS

CVE•added 2024/07/30 6:15 p.m.•48 views

CVE-2024-41305

A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.

7.1CVSS7.4AI score0.00038EPSS

CVE•added 2025/04/02 11:15 p.m.•42 views

CVE-2025-3123

A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exp...

7.2CVSS7.1AI score0.00129EPSS

CVE•added 2017/03/17 2:59 p.m.•30 views

CVE-2014-8701

Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.

7.5CVSS7.3AI score0.00315EPSS