OTCMS vulnerabilities
We track 8 vulnerabilities in OTCMS products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on March 27, 2026.
Latest OTCMS vulnerabilities
- 7.5 High severity
Otcms: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before. The vulnerability allows remote attackers to craft HTTP requests, without authentication, containing a URL pointing to internal servi
- 7.2 High severity
OTCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely.
- 7.5 High severity
OTCMS: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been
- 7.5 High severity
OTCMS: Path Traversal: '../filedir'
A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has bee
- 9.8 Critical severity
OTCMS: Server-Side Request Forgery
A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The a
- 9.8 Critical severity
OTCMS: Use of Hard-coded Credentials
A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the pu
- 9.8 Critical severity
OTCMS: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit h
- 9.8 Critical severity
OTCMS: Server-Side Request Forgery
A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to laun