Vulnerabilities > Wondercms > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-07-30 | CVE-2024-41305 | Server-Side Request Forgery (SSRF) vulnerability in Wondercms 3.4.3 A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter. | 4.7 |
| 2023-11-07 | CVE-2023-41425 | Cross-site Scripting vulnerability in Wondercms Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. | 6.1 |
| 2022-11-17 | CVE-2022-43332 | Cross-site Scripting vulnerability in Wondercms 3.3.4 A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel. | 6.1 |
| 2020-12-30 | CVE-2020-29469 | Cross-site Scripting vulnerability in Wondercms 3.1.3 WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. | 5.4 |
| 2020-12-30 | CVE-2020-29233 | Cross-site Scripting vulnerability in Wondercms 3.1.3 WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. | 5.4 |
| 2020-12-24 | CVE-2020-29247 | Cross-site Scripting vulnerability in Wondercms 3.1.3 WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. | 4.8 |
| 2019-09-12 | CVE-2019-5956 | Path Traversal vulnerability in Wondercms Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors. | 6.5 |
| 2018-02-27 | CVE-2018-7172 | Path Traversal vulnerability in Wondercms In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal. | 4.9 |
| 2018-02-09 | CVE-2018-1000062 | Cross-site Scripting vulnerability in Wondercms 2.4.0 WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction(), 'svg' => 'image/svg+xml' that can result in An attacker can execute arbitrary script on an unsuspecting user's browser. | 4.4 |
| 2018-01-26 | CVE-2017-14522 | Cross-site Scripting vulnerability in Wondercms 2.3.1 In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. | 6.1 |