WonderCMS 3.5.0
Approved changes feed: RSS · Atom
cpe:2.3:a:wondercms:wondercms:3.5.0:*:*:*:*:*:*:*
part: a version: 3.5.0 update: *
| Vendor | Wondercms (0662ffc5-32b5-5dde-87bb-37e881a45788) |
|---|---|
| Product | Wondercms (0877b2ee-e4a9-5f4c-ab49-b9b2fbb88185) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/robiso/wondercms |
purl2cpe | 2026-06-01 10:13:28.638347 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-57055 |
vulnerable | 2026-06-08 07:33:15.767758 |
Details available
WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using curl_exec() without sufficient validation, allowing the attacker to force internal or external HTTP requests.
Published: 2025-09-17T00:00:00.000Z
Updated: 2025-09-17T17:23:49.120Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3123 |
vulnerable | 2026-06-08 07:23:08.189064 |
WonderCMS Theme Installation/Plugin Installation installUpdateModuleAction unrestricted upload
MEDIUM (4.7)
A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he philosophy has always been, admin [...] bear responsibility to not install themes/plugins from untrusted sources."
Published: 2025-04-02T22:31:04.900Z
Updated: 2025-04-03T14:07:27.286Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.