PatchTheCVEduxcms project vulnerabilities
Recent CVEs affecting duxcms project products. 6 tracked.
duxcms project has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2023-07-31. Highest priority: CVE-2020-21862 (score 49/100).
- CVE-2020-36763 MEDIUM 5.4 DOWNGRADE Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the c
- CVE-2020-36610 MEDIUM 4.3 DOWNGRADE A vulnerability was found in annyshow DuxCMS 2.1
- CVE-2020-36609 LOW 2.4 DOWNGRADE A vulnerability was found in annyshow DuxCMS 2.1
- CVE-2020-21881 MEDIUM 6.5 DOWNGRADE Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify
- CVE-2020-21862 HIGH 8.1 DOWNGRADE Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBac
- CVE-2020-21861 HIGH 8.8 DOWNGRADE File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/
FAQ
How do I fix duxcms project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is duxcms project being exploited right now?
None of the tracked duxcms project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which duxcms project CVE should I patch first?
CVE-2020-21862 currently ranks highest (49/100): Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBac.