GCVE - cpe:2.3:a:dingfanzu:cms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:dingfanzu:cms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Dingfanzu (`469a43df-8d6a-5a8a-9944-94487fda3a1b`)
Product	Cms (`62d053d9-8f7b-57c2-a646-b380a2a7b2b9`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-1544`	vulnerable	2026-06-08 07:08:37.217851	dingfanzu CMS loadShopInfo.php sql injection MEDIUM (6.3) A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.php. The manipulation of the argument shopId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-02-21T16:00:11.285Z Updated: 2025-02-25T14:50:23.281Z Open on db.gcve.eu Reference links https://vuldb.com/?id.296490 https://vuldb.com/?ctiid.296490 https://vuldb.com/?submit.497477 https://github.com/XinCaoZ/cve/blob/main/dingfanzu/dingfanzu-CMS%20loadShopInfo.php%20shopId%20SQL%20inject.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-9294`	vulnerable	2026-06-08 07:00:27.078530	dingfanzu CMS saveNewPwd.php sql injection MEDIUM (6.3) A vulnerability, which was classified as critical, has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected by this issue is some unknown functionality of the file saveNewPwd.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Published: 2024-09-27T21:31:04.050Z Updated: 2024-09-30T16:10:41.862Z Open on db.gcve.eu Reference links https://vuldb.com/?id.278786 https://vuldb.com/?ctiid.278786 https://vuldb.com/?submit.412364 https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20saveNewPwd.php%20username%20SQL-inject.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-8303`	vulnerable	2026-06-08 07:00:24.153529	dingfanzu CMS getBasicInfo.php sql injection MEDIUM (6.3) A vulnerability classified as critical has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. This affects an unknown part of the file /ajax/getBasicInfo.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2024-08-29T14:31:04.023Z Updated: 2024-08-29T15:45:20.745Z Open on db.gcve.eu Reference links https://vuldb.com/?id.276075 https://vuldb.com/?ctiid.276075 https://vuldb.com/?submit.396298 https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20getBasicInfo.php%20username%20SQL-inject.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-8302`	vulnerable	2026-06-08 07:00:24.144614	dingfanzu CMS chpwd.php sql injection MEDIUM (6.3) A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ajax/chpwd.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2024-08-29T14:00:06.289Z Updated: 2024-08-29T14:31:48.285Z Open on db.gcve.eu Reference links https://vuldb.com/?id.276074 https://vuldb.com/?ctiid.276074 https://vuldb.com/?submit.396297 https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20chpwd.php%20username%20SQL-inject.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-8301`	vulnerable	2026-06-08 07:00:24.141040	dingfanzu CMS checkin.php sql injection HIGH (7.3) A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax/checkin.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2024-08-29T13:00:05.967Z Updated: 2024-08-29T13:22:22.236Z Open on db.gcve.eu Reference links https://vuldb.com/?id.276073 https://vuldb.com/?ctiid.276073 https://vuldb.com/?submit.396294 https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20checkin.php%20username%20SQL-inject.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-48758`	vulnerable	2026-06-08 06:50:09.849716	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Cms

Notes

PURL mappings

Vulnerability references

Contribute