Xiweicheng vulnerabilities
We track 2 vulnerabilities in Xiweicheng products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on January 17, 2026.
2vulnerabilities
2critical
0high
0exploited
9.8average CVSS score
Latest Xiweicheng vulnerabilities
- 9.8 Critical severity
TMS: Server-Side Request Forgery
A flaw has been found in xiweicheng TMS up to 2.28.0. This affects the function Summary of the file src/main/java/com/lhjz/portal/util/HtmlUtil.java. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attac
- 9.8 Critical severity
TMS: Unrestricted Upload of File with Dangerous Type
A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller/FileController.java. The manipulation of the argument filename results in unrestricted upload. The a