Ideacms vulnerabilities
5 known vulnerabilities affecting ideacms/ideacms.
Total CVEs
5
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH2MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2025-5569P2HIGHCVSS 8.8PoC≤ 1.7v1.2+5 more2025-06-04
CVE-2025-5569 [HIGH] CWE-74 CVE-2025-5569: A vulnerability was found in IdeaCMS up to 1.7 and classified as critical. This issue affects the fu
A vulnerability was found in IdeaCMS up to 1.7 and classified as critical. This issue affects the function Article/Goods of the file /api/v1.index.article/getList.html. The manipulation of the argument Field leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.8 is able to address this issue. The patch is named 935aceb4c21
nvd
CVE-2025-11331P2HIGHCVSS 7.2≤ 1.8v1.0+8 more2025-10-06
CVE-2025-11331 [HIGH] CWE-74 CVE-2025-11331: A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the f
A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Website Name Handler. Performing manipulation of the argument 网站名称 results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor w
nvd
CVE-2025-4291P2CRITICALCVSS 9.8≤ 1.6v1.0+6 more2025-05-05
CVE-2025-4291 [CRITICAL] CWE-284 CVE-2025-4291: A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the f
A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
nvd
CVE-2025-14245P3CRITICALCVSS 9.8≤ 1.8v1.0+8 more2025-12-08
CVE-2025-14245 [CRITICAL] CWE-74 CVE-2025-14245: A vulnerability has been found in IdeaCMS up to 1.8. This affects the function whereRaw of the file
A vulnerability has been found in IdeaCMS up to 1.8. This affects the function whereRaw of the file app/common/logic/index/Coupon.php. Such manipulation of the argument params leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
nvd
CVE-2018-16372P4MEDIUMCVSS 6.1≤ 2016-04-302018-09-03
CVE-2018-16372 [MEDIUM] CWE-79 CVE-2018-16372: The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=c
The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw parameter. NOTE: this product is discontinued.
nvd