Ulicms vulnerabilities
We track 3 vulnerabilities in Ulicms products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on December 17, 2025.
Latest Ulicms vulnerabilities
- 8.8 High severity
Ulicms: Unrestricted Upload of File with Dangerous Type
UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar upload. Attackers can trigger code execution by visiting the uploaded file's locatio
- 9.8 Critical severity
Ulicms: Missing Authorization
UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters
- 9.8 Critical severity
Ulicms: Authorization Bypass Through User-Controlled Key
UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific par