Html-JS / Doracms
10 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-3795 | doramart DoraCMS v1.js createFileBypath path traversal | MEDIUM | 5.3 | Mar 9, 2026 |
| CVE-2026-3794 | doramart DoraCMS Email API send improper authentication | MEDIUM | 6.9 | Mar 9, 2026 |
| CVE-2024-28715 | Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/publi… | HIGH | 8.8 | Mar 19, 2024 |
| CVE-2023-51840 | DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key. | CRITICAL | 9.8 | Jan 29, 2024 |
| CVE-2023-49444 | An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avata… | MEDIUM | 5.4 | Dec 8, 2023 |
| CVE-2023-49443 | DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to… | CRITICAL | 9.8 | Dec 8, 2023 |
| CVE-2022-35147 | DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request. | CRITICAL | 9.8 | Aug 17, 2022 |
| CVE-2022-25464 | A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrary web scripts or HT… | MEDIUM | 4.8 | Mar 20, 2022 |
| CVE-2020-18220 | Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CB… | HIGH | 7.5 | May 20, 2021 |
| CVE-2018-16622 | Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via… | MEDIUM | 5.4 | Sep 6, 2018 |
Showing 1 to 10 of 10 CVEs