articlecms project vulnerabilities

Products

• articlecms 4

Latest articlecms project CVEs

Newest publication first

1. CVE-2020-28063 A file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell.

   Published 2021-05-13

   Critical·CVSS 9.8

   A file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell.

2. CVE-2020-20092 File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote....

   Published 2021-05-13

   Critical·CVSS 9.8

   File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute arbitrary PHP code.

3. CVE-2018-19469 ArticleCMS through 2017-02-19 has XSS via the /update_personal_infomation realname or email parameter.

   Published 2018-11-23

   Medium·CVSS 6.1

   ArticleCMS through 2017-02-19 has XSS via the /update_personal_infomation realname or email parameter.

4. CVE-2018-12339 ArticleCMS through 2017-02-19 has XSS via an "add an article" action.

   Published 2018-06-13

   Medium·CVSS 5.4

   ArticleCMS through 2017-02-19 has XSS via an "add an article" action.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.