WuzhiCMS vulnerabilities
We track 5 vulnerabilities in WuzhiCMS products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
Latest WuzhiCMS vulnerabilities
- 7.3 High severity
WuzhiCMS: Server-Side Request Forgery
A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request fo
- 7.3 High severity
WuzhiCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/master_table leads to sql injection. Remote
- 7.2 High severity
WuzhiCMS: Improper Control of Generation of Code
A vulnerability was found in WuzhiCMS 4.1. It has been rated as critical. Affected by this issue is the function Set of the file /index.php?m=attachment&f=index&_su=wuzhicms&v=set&submit=1 of the component Setting Handler. The manipulation of the argument Sett
- 7.2 High severity
wuzhicms: Improper Control of Generation of Code
A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. Th
- 9.8 Critical severity
Wuzhicms: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/database/admin/index.php component.