Cherry-toto/jizhicms

GitHub

github.com

www.jizhicms.cn

Releases46

Frequency1 month 3 weeks

Last Release about 1 month ago

Stars212

极致CMS（以下简称:JIZHICMS）是一款开源免费，无商业授权的建站系统。

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-50229 ↗	Apr 23, 2026Thursday, 23 April 2026, 16:16	9.8 CRITICAL	—
Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.
CVE-2025-50228 ↗	Apr 9, 2026Thursday, 9 April 2026, 15:16	9.1 CRITICAL	—
Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.
CVE-2024-34255 ↗	May 8, 2024Wednesday, 8 May 2024, 13:15	6.1 MEDIUM	—
jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function.
CVE-2024-33338 ↗	Apr 29, 2024Monday, 29 April 2024, 18:15	7.3 HIGH	—
Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request.
CVE-2023-50692 ↗	Dec 28, 2023Thursday, 28 December 2023, 06:15	8.8 HIGH	—
File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.
CVE-2023-31862 ↗	May 19, 2023Friday, 19 May 2023, 13:15	5.4 MEDIUM	—
jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published in the front end is only filtered in the front end, without being filtered in the background, which allows attackers to publish an article containing malicious JavaScript scripts by modifying the request package.
CVE-2023-27235 ↗	Mar 15, 2023Wednesday, 15 March 2023, 05:15	7.2 HIGH	—
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.
CVE-2023-27234 ↗	Mar 15, 2023Wednesday, 15 March 2023, 05:15	6.5 MEDIUM	—
A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application.
CVE-2022-45278 ↗	Nov 23, 2022Wednesday, 23 November 2022, 21:15	8.8 HIGH	—
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.
CVE-2022-44140 ↗	Nov 23, 2022Wednesday, 23 November 2022, 20:15	8.8 HIGH	—
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.
CVE-2022-36578 ↗	Aug 19, 2022Friday, 19 August 2022, 17:15	9.8 CRITICAL	—
jizhicms v2.3.1 has SQL injection in the background.
CVE-2022-36577 ↗	Aug 19, 2022Friday, 19 August 2022, 17:15	8.8 HIGH	—
An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin.
CVE-2022-31393 ↗	Jun 9, 2022Thursday, 9 June 2022, 14:15	9.1 CRITICAL	6.4 MEDIUM
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.
CVE-2022-31390 ↗	Jun 9, 2022Thursday, 9 June 2022, 14:15	9.1 CRITICAL	6.4 MEDIUM
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.
CVE-2022-27429 ↗	Apr 25, 2022Monday, 25 April 2022, 13:15	9.8 CRITICAL	7.5 HIGH
Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.
CVE-2020-21228 ↗	Oct 1, 2021Friday, 1 October 2021, 21:15	6.1 MEDIUM	4.3 MEDIUM
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.
CVE-2020-23644 ↗	Jan 11, 2021Monday, 11 January 2021, 14:15	6.1 MEDIUM	4.3 MEDIUM
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.
CVE-2020-23643 ↗	Jan 11, 2021Monday, 11 January 2021, 14:15	6.1 MEDIUM	4.3 MEDIUM
XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php.
CVE-2019-17593 ↗	Oct 14, 2019Monday, 14 October 2019, 21:15	8.8 HIGH	6.8 MEDIUM
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.