UJCMS 9.6.3
Approved changes feed: RSS · Atom
cpe:2.3:a:ujcms:ujcms:9.6.3:*:*:*:*:*:*:*part: a version: 9.6.3 update: *
| Vendor | Ujcms (38cf157c-add1-5f42-84f8-44071b77f008) |
|---|---|
| Product | Ujcms (6a32357c-45f8-546f-ab44-c5899c55b053) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gitee/jspxcms/jspxcms |
purl2cpe | 2026-06-01 10:17:04.599739 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-55452 |
vulnerable | 2026-06-08 06:54:16.999351 |
Details available
A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage.
Published: 2024-12-16T00:00:00.000Z
Updated: 2024-12-17T14:42:59.416Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-55451 |
vulnerable | 2026-06-08 06:54:16.998957 |
Details available
A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises from insufficient sanitization of embedded attributes in uploaded SVG files. When a maliciously crafted SVG file is viewed by other backend users, it allows authenticated attackers to execute arbitrary JavaScript in the context of other backend users' browsers, potentially leading to the theft of sensitive tokens.
Published: 2024-12-16T00:00:00.000Z
Updated: 2024-12-17T16:56:32.250Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.