CVE-2020-18654

2021-06-2216:15:07

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.1%

JSON

Cross Site Scripting (XSS) in Wuzhi CMS v4.1.0 allows remote attackers to execute arbitrary code via the “Title” parameter in the component “/coreframe/app/guestbook/myissue.php”.

CPENameOperatorVersion
wuzhicmseq3.0.4.0
wuzhicmseq2.1.6
wuzhicmseq3.0.3
wuzhicmseq3.0.1
wuzhicmseq2.1.7
wuzhicmseq2.1.2
wuzhicmseq3.1.0
wuzhicmseq3.1.0.1
wuzhicmseq2.0.4
wuzhicmseq3.1.1

Name	Operator	Version
wuzhicms	eq	3.0.4.0
wuzhicms	eq	2.1.6
wuzhicms	eq	3.0.3
wuzhicms	eq	3.0.1
wuzhicms	eq	2.1.7
wuzhicms	eq	2.1.2
wuzhicms	eq	3.1.0
wuzhicms	eq	3.1.0.1
wuzhicms	eq	2.0.4
wuzhicms	eq	3.1.1

Rows per page:

1-10 of 201

References

github.com/wuzhicms/wuzhicms/issues/174