Publiccms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-69437 PublicCMS v5.202506.d and earlier is vulnerable to stored XSS.High 8.7 · Feb 27, 2026
• CVE-2025-65840 PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.High 8.8 · Dec 1, 2025
• CVE-2025-65838 PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.High 7.5 · Dec 1, 2025
• CVE-2025-65836 PublicCMS V5.202506.b is vulnerable to SSRF.Critical 9.1 · Dec 1, 2025
• CVE-2025-57516 OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DAHigh 8.2 · Sep 29, 2025
• CVE-2025-25361 An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code Critical 9.8 · Mar 6, 2025
• CVE-2024-42523 publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaDataHigh 7.2 · Aug 23, 2024
• CVE-2024-40552 PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java.High 8.8 · Jul 12, 2024
• CVE-2024-40551 An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via upHigh 8.8 · Jul 12, 2024
• CVE-2024-40550 An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary High 8.8 · Jul 12, 2024
• CVE-2024-40549 An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uHigh 8.8 · Jul 12, 2024
• CVE-2024-40548 An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploadHigh 8.8 · Jul 12, 2024
• CVE-2024-40546 An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploadiHigh 8.8 · Jul 12, 2024
• CVE-2024-40545 An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uplHigh 8.8 · Jul 12, 2024
• CVE-2024-40544 PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit.High 8.8 · Jul 12, 2024
• CVE-2024-40543 PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage.High 8.8 · Jul 12, 2024
• CVE-2024-31759 An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.High 8.8 · Apr 16, 2024
• CVE-2023-46990 Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace functiCritical 9.8 · Nov 20, 2023
• CVE-2023-34852 PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.Critical 9.8 · Jun 15, 2023
• CVE-2020-20915 SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSiteAdminControl.Critical 9.8 · Apr 4, 2023
• CVE-2020-20914 SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.Critical 9.8 · Apr 4, 2023
• CVE-2021-27693 Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.Critical 9.8 · Sep 2, 2022
• CVE-2022-23389 PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.Critical 9.8 · Feb 14, 2022
• CVE-2021-40881 An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.Critical 9.8 · Sep 15, 2021
• CVE-2018-12914 A remote code execution issue was discovered in PublicCMS V4.0.20180210.Critical 9.8 · Jun 27, 2018