彙總 bluecms_project 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 SQL 注入與路徑處理缺陷 等問題，部分漏洞可能導致 資料外洩，並影響 軟體部署與生產負載 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2025-29150 | BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request. | [email protected] | 4.3 | 0.36% | 2025-04-10 | 2026-06-17 |
| CVE-2024-45894 | BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request. | [email protected] | 4.9 | 0.33% | 2024-10-07 | 2026-06-17 |
| CVE-2023-33734 | BlueCMS v1.6 was discovered to contain a SQL injection vulnerability via the keywords parameter at search.php. | [email protected] | 9.8 | 0.75% | 2023-05-30 | 2026-06-17 |
| CVE-2022-37113 | Bluecms 1.6 has SQL injection in line 132 of admin/area.php | [email protected] | 9.8 | 14.42% | 2022-08-23 | 2026-06-17 |
| CVE-2022-37112 | BlueCMS 1.6 has SQL injection in line 55 of admin/model.php | [email protected] | 9.8 | 0.76% | 2022-08-23 | 2026-06-17 |
| CVE-2022-37111 | BlueCMS 1.6 has SQL injection in line 132 of admin/article.php | [email protected] | 9.8 | 0.78% | 2022-08-23 | 2026-06-17 |
| CVE-2022-27962 | Bluecms 1.6 has a SQL injection vulnerability at cooike. | [email protected] | 9.8 | 1.03% | 2022-05-03 | 2026-06-17 |
| CVE-2020-19853 | BlueCMS v1.6 contains a SQL injection vulnerability via /ad_js.php. | [email protected] | 9.8 | 1.10% | 2021-09-07 | 2026-06-16 |
| CVE-2019-10262 | A SQL Injection issue was discovered in BlueCMS 1.6. The variable $ad_id is spliced directly in uploads/admin/ad.php in the admin folder, and is not wrapped in single quotes, resulting in injection around the escape of magic quotes. | [email protected] | 9.8 | 1.45% | 2019-03-28 | 2026-06-16 |
| CVE-2019-9594 | BlueCMS 1.6 allows SQL Injection via the user_id parameter in an uploads/admin/user.php?act=edit request. | [email protected] | 9.8 | 1.45% | 2019-03-06 | 2026-06-16 |
| CVE-2018-16432 | BlueCMS 1.6 allows SQL Injection via the user_name parameter to uploads/user.php?act=index_login. | [email protected] | 9.8 | 1.14% | 2018-09-03 | 2026-06-16 |
| CVE-2010-4897 | SQL injection vulnerability in comment.php in BlueCMS 1.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header in a send action. | [email protected] | 7.5 | 1.10% | 2011-10-08 | 2026-06-16 |