umi-cms vulnerabilities

Products

• umi cms 1
• umi.cms 1

Latest umi-cms CVEs

Newest publication first

1. CVE-2013-2754 Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hijack the authentication of administrators for requests that add administrator acc...

   Published 2014-03-11

   Medium·CVSS 6.8 EPSS 2.3% Public exploit

   Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via a request to admin/users/add/user/do/.

2. CVE-2007-5428 Cross-site scripting (XSS) vulnerability in UMI CMS allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to the default URI in search_do/.

   Published 2007-10-12

   Medium·CVSS 4.3 EPSS 1.5% Public exploit

   Cross-site scripting (XSS) vulnerability in UMI CMS allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to the default URI in search_do/.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.