Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Oct 15, 2026ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every CVE-2026-111352 · Other software · ThinkCMF · reported by VulnCheckHigh 8.7
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
- Product
- ThinkCMF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7.CVE-2026-102771 · Other software · Naichen · reported by VulDBLow 2
A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ThinkCMF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.CVE-2024-31615 · Other software · thinkcmf · reported by MITRECritical 9.8
ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.
- Product
- thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.CVE-2020-25915 · Other software · Thinkcmf · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2022ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS).CVE-2022-40849 · Other software · Thinkcmf · reported by MITREMedium 5.4
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2022ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrativCVE-2022-40489 · Other software · Thinkcmf · reported by MITREHigh 8.8
ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022thinkcmf v5.1.7 has an unauthorized vulnerability.CVE-2021-40616 · Other software · Thinkcmf · reported by MITREMedium 6.5
thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user management group authority is required.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2021An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.CVE-2020-20601 · Other software · Thinkcmf · reported by MITRECritical 9.8
An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.riskivy.comblog.riskivy.com
Jul 14, 2021Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.CVE-2020-18151 · Other software · Thinkcmf · reported by MITREMedium 6.5
Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2019ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of CVE-2019-7580 · Other software · Thinkcmf · reported by MITREHigh 8.8
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comxz.aliyun.com
Jan 23, 2019app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/indCVE-2019-6713 · Other software · Thinkcmf · reported by MITRECritical 9.8
app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a file_put_contents call.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2018ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users via the post[id][1] pCVE-2018-19898 · Other software · Thinkcmf · reported by MITREHigh 8.8
ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users via the post[id][1] parameter in an article edit_post action.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2018ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listordeCVE-2018-19897 · Other software · Thinkcmf · reported by MITREHigh 7.2
ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2018ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] parameter iCVE-2018-19896 · Other software · Thinkcmf · reported by MITREHigh 7.2
ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] parameter in a slide action.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2018ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the parentid parametCVE-2018-19895 · Other software · Thinkcmf · reported by MITREHigh 7.2
ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the parentid parameter in a nav action.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2018ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via tCVE-2018-19894 · Other software · Thinkcmf · reported by MITREHigh 7.2
ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2018ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter wiCVE-2018-16141 · Other software · Thinkcmf · reported by MITREMedium 6.5
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server.
- Product
- Thinkcmfx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordunothing.github.iounothing.github.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.