WonderCMS 2.3.1

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:wondercms:wondercms:2.3.1:*:*:*:*:*:*:*

part: a version: 2.3.1 update: *

VendorWondercms (0662ffc5-32b5-5dde-87bb-37e881a45788)
ProductWondercms (0877b2ee-e4a9-5f4c-ab49-b9b2fbb88185)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/robiso/wondercms purl2cpe 2026-06-01 10:13:28.638303

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2017-14523 vulnerable 2026-06-08 05:08:50.088522 Details available
WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack
Published: 2018-01-26T20:00:00.000Z
Updated: 2024-08-05T19:27:40.782Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2017-14522 vulnerable 2026-06-08 05:08:50.088195 Details available
In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website
Published: 2018-01-26T20:00:00.000Z
Updated: 2024-08-05T19:27:40.861Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2017-14521 vulnerable 2026-06-08 05:08:50.087682 Details available
In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.
Published: 2018-01-26T20:00:00.000Z
Updated: 2024-08-05T19:27:40.825Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.