Ujcms

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Ujcms product.

RSS Feeds for Ujcms security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Ujcms products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Ujcms Sorted by Most Security Vulnerabilities since 2018

Ujcms12 vulnerabilities

Ujcms Jspxcms6 vulnerabilities

By the Year

In 2026 there have been 2 vulnerabilities in Ujcms with an average score of 5.9 out of ten. Last year, in 2025 Ujcms had 1 security vulnerability published. That is, 1 more vulnerability have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	2	5.85
2025	1	0.00
2024	8	6.15
2023	5	7.94
2022	2	8.15

It may take a day or so for new Ujcms vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Ujcms Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-2954	Feb 22, 2026	UJCMS 10.0.2 Remote Injection via ImportDataCtrl A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ujcms
CVE-2026-2953	Feb 22, 2026	Path Traversal in Dromara UJCMS 101.2 Template Handler deleteDirectory A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the component Template Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ujcms
CVE-2025-25772	Feb 21, 2025	CSRF in Jspxcms v9.0-9.5 UserController allows arbitrary admin addition A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted request.	Jspxcms
CVE-2024-55452	Dec 16, 2024	UJCMS URL Redirection Vulnerability in Block/Carousel Item Handling A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage.	Ujcms
CVE-2024-55451	Dec 16, 2024	UJCMS 9.6.3: Stored XSS via Authenticated SVG File Upload A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises from insufficient sanitization of embedded attributes in uploaded SVG files. When a maliciously crafted SVG file is viewed by other backend users, it allows authenticated attackers to execute arbitrary JavaScript in the context of other backend users' browsers, potentially leading to the theft of sensitive tokens.	Ujcms
CVE-2024-12483	Dec 12, 2024	Auth Bypass in Dromara UJCMS <9.6.3 User ID Handler A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.	Ujcms
CVE-2024-1257	Feb 06, 2024	Jspxcms 10.2.0 Remote XSS in /ext/collect/find_text.do A vulnerability was found in Jspxcms 10.2.0. It has been classified as problematic. Affected is an unknown function of the file /ext/collect/find_text.do. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252996.	Jspxcms
CVE-2024-1256	Feb 06, 2024	XSS in Jspxcms 10.2.0 /ext/collect/filter_text.do A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. This issue affects some unknown processing of the file /ext/collect/filter_text.do. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252995.	Jspxcms
CVE-2024-0599	Jan 16, 2024	CVE-2024-0599 Jspxcms 10.2.0 XSS in InfoController.title A vulnerability was found in Jspxcms 10.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file src\main\java\com\jspxcms\core\web\back\InfoController.java of the component Document Management Page. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250837 was assigned to this vulnerability.	Jspxcms
CVE-2023-51806	Jan 12, 2024	Ujcms 8.0.2 File Upload RCE via Crafted File File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.	Ujcms