ClassCMS vulnerabilities
We track 4 vulnerabilities in ClassCMS products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on February 3, 2025.
Latest ClassCMS vulnerabilities
- 9.8 Critical severity
Classcms: Improper Control of Generation of Code
ClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in the classview parameter of the model management feature, allowing them to execute arbitrary code and potentially take control of the server.
- 8.8 High severity
ClassCMS: Incorrect Privilege Assignment
A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper hand
- 9.8 Critical severity
classcms: Unrestricted Upload of File with Dangerous Type
ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to execute PHP code.
- 7.8 High severity
Classcms: Unrestricted Upload of File with Dangerous Type
Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file.