Approved changes feed: RSS · Atom
cpe:2.3:a:wondercms:wondercms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Wondercms (0662ffc5-32b5-5dde-87bb-37e881a45788) |
|---|---|
| Product | Wondercms (0877b2ee-e4a9-5f4c-ab49-b9b2fbb88185) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/robiso/wondercms |
purl2cpe | 2026-06-01 10:13:28.638282 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-58305 |
vulnerable | 2026-06-08 06:56:14.397328 |
WonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module Installation
HIGH (8.8)
WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an authenticated administrator into accessing a malicious link.
Published: 2025-12-12T19:56:58.058Z
Updated: 2026-04-07T14:08:48.822Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41304 |
vulnerable | 2026-06-08 06:43:54.326736 |
Details available
An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file.
Published: 2024-07-30T00:00:00.000Z
Updated: 2024-08-23T15:20:48.730Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32746 |
vulnerable | 2026-06-08 06:37:23.774650 |
Details available
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the MENU parameter under the Menu module.
Published: 2024-04-17T00:00:00.000Z
Updated: 2024-08-02T02:20:35.266Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32743 |
vulnerable | 2026-06-08 06:37:23.769713 |
Details available
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SITE LANGUAGE CONFIG parameter under the Security module.
Published: 2024-04-17T00:00:00.000Z
Updated: 2024-08-02T02:20:35.267Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32339 |
vulnerable | 2026-06-08 06:35:33.060210 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters.
Published: 2024-04-17T00:00:00.000Z
Updated: 2024-08-02T02:06:44.051Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32338 |
vulnerable | 2026-06-08 06:35:33.059661 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41425 |
vulnerable | 2026-06-08 06:11:06.101088 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-5956 |
vulnerable | 2026-06-08 05:14:08.295943 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-7172 |
vulnerable | 2026-06-08 05:11:55.103525 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-14387 |
vulnerable | 2026-06-08 05:10:52.856544 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7951 |
vulnerable | 2026-06-08 05:10:06.611343 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-5317 |
vulnerable | 2026-06-08 04:59:35.509780 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.