PublicCMS vulnerabilities

We track 11 vulnerabilities in PublicCMS products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on February 27, 2026.

11vulnerabilities

2critical

9high

0exploited

8.9average CVSS score

Latest PublicCMS vulnerabilities

8.7 High severity
Publiccms: Improper Neutralization of Input During Web Page Generation
CVE-2025-69437Feb 27, 2026PublicCMS
PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it
8.2 High severity
Publiccms: Improper Neutralization of Special Elements used in an OS Command
CVE-2025-57516Sep 29, 2025PublicCMSEPSS 1.15%
OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat file.
9.8 Critical severity
Publiccms: Unrestricted Upload of File with Dangerous Type
CVE-2025-25361Mar 6, 2025PublicCMS
An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file.
8.8 High severity
publiccms: Improper Control of Generation of Code
CVE-2024-40552Jul 12, 2024PublicCMS
PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java.
8.8 High severity
publiccms: Unrestricted Upload of File with Dangerous Type
CVE-2024-40551Jul 12, 2024PublicCMS
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
8.8 High severity
publiccms: Unrestricted Upload of File with Dangerous Type
CVE-2024-40550Jul 12, 2024PublicCMS
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
8.8 High severity
publiccms: Unrestricted Upload of File with Dangerous Type
CVE-2024-40549Jul 12, 2024PublicCMS
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
8.8 High severity
publiccms: Unrestricted Upload of File with Dangerous Type
CVE-2024-40548Jul 12, 2024PublicCMS
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
8.8 High severity
publiccms: Unrestricted Upload of File with Dangerous Type
CVE-2024-40546Jul 12, 2024PublicCMS
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
8.8 High severity
publiccms: Unrestricted Upload of File with Dangerous Type
CVE-2024-40545Jul 12, 2024PublicCMS
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
9.8 Critical severity
Publiccms: Deserialization of Untrusted Data
CVE-2023-46990Nov 20, 2023PublicCMSEPSS 1.46%
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.