Export limit exceeded: 399584 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-102771 1 Thinkcmf 1 Thinkcmf 2026-09-29 4.7 Medium
A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2022-40849 1 Thinkcmf 1 Thinkcmf 2025-04-24 5.4 Medium
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).
CVE-2022-40489 1 Thinkcmf 1 Thinkcmf 2025-04-24 8.8 High
ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.
CVE-2024-31615 1 Thinkcmf 1 Thinkcmf 2025-04-16 9.8 Critical
ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.
CVE-2021-40616 1 Thinkcmf 1 Thinkcmf 2024-11-21 6.5 Medium
thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user management group authority is required.
CVE-2020-25915 1 Thinkcmf 1 Thinkcmf 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.
CVE-2020-20601 1 Thinkcmf 1 Thinkcmf 2024-11-21 9.8 Critical
An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.
CVE-2020-18151 1 Thinkcmf 1 Thinkcmf 2024-11-21 6.5 Medium
Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.
CVE-2019-7580 1 Thinkcmf 1 Thinkcmf 2024-11-21 N/A
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection.
CVE-2019-6713 1 Thinkcmf 1 Thinkcmf 2024-11-21 N/A
app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a file_put_contents call.
CVE-2018-19898 1 Thinkcmf 1 Thinkcmf 2024-11-21 N/A
ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users via the post[id][1] parameter in an article edit_post action.
CVE-2018-19897 1 Thinkcmf 1 Thinkcmf 2024-11-21 N/A
ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action.
CVE-2018-19896 1 Thinkcmf 1 Thinkcmf 2024-11-21 N/A
ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] parameter in a slide action.
CVE-2018-19895 1 Thinkcmf 1 Thinkcmf 2024-11-21 N/A
ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the parentid parameter in a nav action.
CVE-2018-19894 1 Thinkcmf 1 Thinkcmf 2024-11-21 N/A
ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action.
CVE-2018-16141 1 Thinkcmf 1 Thinkcmfx 2024-11-21 N/A
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server.