PatchTheCVEduxcms vulnerabilities and fixes
Recent CVEs affecting duxcms, with upgrade or downgrade steps. 6 tracked.
duxcms has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2023-07-31. Highest priority: CVE-2020-21862 (score 49/100).
- CVE-2020-36763 MEDIUM 5.4 DOWNGRADE Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the c
- CVE-2020-36610 MEDIUM 4.3 DOWNGRADE A vulnerability was found in annyshow DuxCMS 2.1
- CVE-2020-36609 LOW 2.4 DOWNGRADE A vulnerability was found in annyshow DuxCMS 2.1
- CVE-2020-21881 MEDIUM 6.5 DOWNGRADE Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify
- CVE-2020-21862 HIGH 8.1 DOWNGRADE Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBac
- CVE-2020-21861 HIGH 8.8 DOWNGRADE File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/
FAQ
How do I fix duxcms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is duxcms being exploited right now?
None of the tracked duxcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which duxcms CVE should I patch first?
CVE-2020-21862 currently ranks highest (49/100): Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBac.