PatchTheCVEwuzhi cms vulnerabilities and fixes
Recent CVEs affecting wuzhi cms, with upgrade or downgrade steps. 9 tracked.
Also searched as: wuzhicms.
wuzhi cms has 9 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-11-05. Highest priority: CVE-2018-14515 (score 64/100).
- CVE-2018-18939 MEDIUM 4.8 DOWNGRADE An issue was discovered in WUZHI CMS 4.1.0
- CVE-2018-17852 CRITICAL 9.8 DOWNGRADE A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname par
- CVE-2018-17832 MEDIUM 6.1 DOWNGRADE XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter.
- CVE-2018-16350 MEDIUM 6.1 DOWNGRADE WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter.
- CVE-2018-16349 MEDIUM 6.1 DOWNGRADE WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add form[remark] parameter.
- CVE-2018-15894 CRITICAL 9.8 DOWNGRADE A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.ph
- CVE-2018-15893 CRITICAL 9.8 DOWNGRADE A SQL injection was discovered in /coreframe/app/admin/copyfrom.php in WUZHI CMS 4.1.0 via the index.php?m=cor
- CVE-2018-14515 CRITICAL 9.8 DOWNGRADE A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL state
- CVE-2018-14513 MEDIUM 6.1 DOWNGRADE An XSS vulnerability was discovered in WUZHI CMS 4.1.0
FAQ
How do I fix wuzhi cms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is wuzhi cms being exploited right now?
None of the tracked wuzhi cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which wuzhi cms CVE should I patch first?
CVE-2018-14515 currently ranks highest (64/100): A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL state.