彙總 phpwcms 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 路徑處理缺陷與跨站腳本 等問題，部分漏洞可能導致 資料外洩，並影響 生產負載與軟體部署 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2021-47783 | Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform. | [email protected] | 5.3 | 0.28% | 2026-01-15 | 2026-06-17 |
| CVE-2025-5499 | A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component. | [email protected] | 6.9 | 0.64% | 2025-06-03 | 2026-06-17 |
| CVE-2025-5498 | A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of the file include/inc_lib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpage_custom leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is r | [email protected] | 5.1 | 0.42% | 2025-06-03 | 2026-06-17 |
| CVE-2025-5497 | A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to resolve this issue. The patch is named 41a72eca0baa9d9d0214fec97db2 | [email protected] | 2.1 | 0.46% | 2025-06-03 | 2026-06-17 |
| CVE-2021-36426 | File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php. | [email protected] | 8.8 | 1.06% | 2023-02-03 | 2026-06-16 |
| CVE-2021-36425 | Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file. | [email protected] | 5.4 | 0.97% | 2023-02-03 | 2026-06-16 |
| CVE-2021-36424 | An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation. | [email protected] | 9.8 | 1.18% | 2023-02-03 | 2026-06-16 |
| CVE-2021-4301 | A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is identified as 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability. | [email protected] | 6.3 | 0.69% | 2023-01-07 | 2026-06-17 |
| CVE-2021-4302 | A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is named b39db9c7ad3800f319195ff0e26a0981395b1c54. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217419. | [email protected] | 3.5 | 0.53% | 2023-01-04 | 2026-06-17 |
| CVE-2020-19855 | phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php. | [email protected] | 6.1 | 0.64% | 2021-09-07 | 2026-06-16 |
| CVE-2020-21784 | phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php. | [email protected] | 9.8 | 1.40% | 2021-06-24 | 2026-06-16 |
| CVE-2018-12990 | phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field. | [email protected] | 5.3 | 1.18% | 2018-06-30 | 2026-06-16 |
| CVE-2017-15872 | phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmpl.php and include/inc_tmpl/admin.newuser.tmpl.php via the username (aka new_login) field. | [email protected] | 4.8 | 0.51% | 2017-10-24 | 2026-06-16 |
| CVE-2011-3789 | phpwcms 1.4.7 r412 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by template/inc_script/frontend_render/disabled/majonavi.php and certain other files. | [email protected] | 5.0 | 1.23% | 2011-09-23 | 2026-06-16 |
| CVE-2006-7019 | phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via crafted arguments to the (1) text_evento and (2) email_eventonome_evento parameters to phpwcms_code_snippets/mail_file_form.php and sample_ext_php/mail_file_form.php, which is processed by the render_PHPcode function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. | [email protected] | 7.5 | 2.46% | 2007-02-14 | 2026-06-16 |
| CVE-2006-6886 | phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for (1) files.public-userroot.inc.php or (2) files.private.additions.inc.php in include/inc_lib/, which reveals the path in various error messages. | [email protected] | 5.0 | 1.57% | 2006-12-31 | 2026-06-16 |
| CVE-2006-2519 | Directory traversal vulnerability in include/inc_ext/spaw/spaw_control.class.php in phpwcms 1.2.5-DEV allows remote attackers to include arbitrary local files via .. (dot dot) sequences in the spaw_root parameter. NOTE: CVE analysis suggests that this issue is actually in SPAW Editor PHP Edition. | [email protected] | 2.6 | 1.62% | 2006-05-22 | 2026-06-16 |
| CVE-2006-2518 | Cross-site scripting (XSS) vulnerability in phpwcms 1.2.5-DEV allows remote attackers to inject arbitrary web script or HTML via the BL[be_cnt_plainhtml] parameter to include/inc_tmpl/content/cnt6.inc.php. | [email protected] | 2.6 | 1.36% | 2006-05-22 | 2026-06-16 |
| CVE-2005-3789 | Multiple directory traversal vulnerabilities in phpwcms 1.2.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) form_lang parameter in login.php and (2) the imgdir parameter in random_image.php. | [email protected] | 5.0 | 3.42% | 2005-11-24 | 2026-06-16 |