Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
May 31, 2026A weakness has been identified in OFCMS 1.1.3.CVE-2026-10204 · Other software · reported by VulDBLow 2.1
A weakness has been identified in OFCMS 1.1.3. The affected element is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SysUserController.java of the component JSON Query Interface. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2026A security flaw has been discovered in OFCMS 1.1.3.CVE-2026-10203 · Other software · reported by VulDBLow 2.1
A security flaw has been discovered in OFCMS 1.1.3. Impacted is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemParamController.java of the component JSON Query Interface. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2026A vulnerability was identified in OFCMS 1.1.3.CVE-2026-10202 · Other software · reported by VulDBLow 2.1
A vulnerability was identified in OFCMS 1.1.3. This issue affects the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemDictController.java of the component JSON Query Interface. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2026A security flaw has been discovered in OFCMS up to 1.1.3.CVE-2026-10193 · Other software · reported by VulDBLow 2.1
A security flaw has been discovered in OFCMS up to 1.1.3. The impacted element is the function Query of the file ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\ComnController.java of the component ComnController. Performing a manipulation of the argument system.user.query results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2025A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3.CVE-2025-1557 · Other software · Ofcms Project · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of the ofcms-admin\src\mCVE-2024-48236 · Other software · ofcms_project · reported by MITREMedium 6.5
An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of the ofcms-admin\src\main\java\com\ofsoft\cms\core\uitle\FileUtils.java file
- Product
- ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file.CVE-2024-48235 · Other software · ofcms_project · reported by MITREMedium 6.5
An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file.
- Product
- ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2024A vulnerability classified as problematic has been found in OFCMS 1.1.2.CVE-2024-9411 · Other software · ofcms_project · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in OFCMS 1.1.2. This affects the function add of the file /admin/system/dict/add.json?sqlid=system.dict.save. The manipulation of the argument dict_value leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.CVE-2024-34256 · Other software · ofcms_project · reported by MITRECritical 9.8
OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.
- Product
- ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition componenCVE-2023-51807 · Other software · Ofcms Project · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2023An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.CVE-2023-24760 · Other software · Ofcms Project · reported by MITREHigh 8.8
An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json.CVE-2022-29653 · Other software · Ofcms Project · reported by MITREMedium 6.1
OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2022-27961 · Other software · Ofcms Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment text box.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' persCVE-2022-27960 · Other software · Ofcms Project · reported by MITREMedium 5.4
Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' personal information.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019An issue was discovered in OFCMS before 1.1.3.CVE-2019-9617 · Other software · Ofcms Project · reported by MITREHigh 8.8
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadFile URI.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019An issue was discovered in OFCMS before 1.1.3.CVE-2019-9616 · Other software · Ofcms Project · reported by MITREHigh 7.2
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadScrawl URI.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019An issue was discovered in OFCMS before 1.1.3.CVE-2019-9615 · Other software · Ofcms Project · reported by MITREHigh 7.2
An issue was discovered in OFCMS before 1.1.3. It allows admin/system/generate/create?sql= SQL injection, related to SystemGenerateController.java.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019An issue was discovered in OFCMS before 1.1.3.CVE-2019-9614 · Other software · Ofcms Project · reported by MITREHigh 8.8
An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with '<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("' followed by the command.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019An issue was discovered in OFCMS before 1.1.3.CVE-2019-9613 · Other software · Ofcms Project · reported by MITREHigh 7.2
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadVideo URI.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019An issue was discovered in OFCMS before 1.1.3.CVE-2019-9612 · Other software · Ofcms Project · reported by MITREHigh 8.8
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/upload URI.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019An issue was discovered in OFCMS before 1.1.3.CVE-2019-9611 · Other software · Ofcms Project · reported by MITREMedium 6.5
An issue was discovered in OFCMS before 1.1.3. It allows admin/cms/template/getTemplates.html?res_path=res directory traversal, with ../ in the dir parameter, to write arbitrary content (in the file_content parameter) into an arbitrary file (specified by the file_name parameter). This is related to the save function in TemplateController.java.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019An issue was discovered in OFCMS before 1.1.3.CVE-2019-9610 · Other software · Ofcms Project · reported by MITREMedium 4.3
An issue was discovered in OFCMS before 1.1.3. It has admin/cms/template/getTemplates.html?res_path=res&up_dir=../ directory traversal, related to the getTemplates function in TemplateController.java.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019An issue was discovered in OFCMS before 1.1.3.CVE-2019-9609 · Other software · Ofcms Project · reported by MITREHigh 8.8
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/editUploadImage URI.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019An issue was discovered in OFCMS before 1.1.3.CVE-2019-9608 · Other software · Ofcms Project · reported by MITREHigh 8.8
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadImage URI.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.