Jizhicms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-50229 Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.Critical 9.8 · Apr 23, 2026
• CVE-2025-50228 Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.Critical 9.1 · Apr 9, 2026
• CVE-2025-70397 jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.High 7.2 · Feb 17, 2026
• CVE-2020-37117 jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files.High 8.6 · Feb 5, 2026
• CVE-2025-25785 JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php.Critical 9.1 · Feb 26, 2025
• CVE-2025-25784 An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a Critical 9.8 · Feb 26, 2025
• CVE-2024-33338 Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request.High 7.3 · Apr 29, 2024
• CVE-2024-32161 jizhiCMS 2.5 suffers from a File upload vulnerability.Critical 9.8 · Apr 17, 2024
• CVE-2023-51154 Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.Critical 9.8 · Jan 4, 2024
• CVE-2023-50692 File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parHigh 8.8 · Dec 28, 2023
• CVE-2023-38948 An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloadingHigh 7.2 · Aug 3, 2023
• CVE-2023-27235 An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafteHigh 7.2 · Mar 15, 2023
• CVE-2021-36484 SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.Critical 9.8 · Feb 3, 2023
• CVE-2022-45278 Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.High 8.8 · Nov 23, 2022
• CVE-2022-44140 Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.High 8.8 · Nov 23, 2022
• CVE-2021-29334 An issue was discovered in JIZHI CMS 1.9.4.High 8.8 · Nov 23, 2022
• CVE-2022-36578 jizhicms v2.3.1 has SQL injection in the background.Critical 9.8 · Aug 19, 2022
• CVE-2022-36577 An issue was discovered in jizhicms v2.3.1.High 8.8 · Aug 19, 2022
• CVE-2022-31393 Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.Critical 9.1 · Jun 9, 2022
• CVE-2022-31390 Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.Critical 9.1 · Jun 9, 2022
• CVE-2022-27429 Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.Critical 9.8 · Apr 25, 2022
• CVE-2020-21483 An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later changed to a PHP file.High 7.2 · Sep 15, 2021
• CVE-2019-17593 JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.High 8.8 · Oct 14, 2019