Login Request a demo
JI
Product
jizhiCMS
by jizhiCMS · last CVE Oct 26, 2026
41
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities41In the news0Timeline
Severity mix
Critical 12High 15Medium 14Low 0
Severity
All severities41Critical12High15Medium14Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add jizhiCMS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-3292
8.8
0%
Feb 27
jizhiCMS Batch Model.php findAll sql injection
Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +1 more
CVE-2020-37117
8.8
1%
Feb 5
jizhiCMS 1.6.7 - Arbitrary File Download
Affected: 1.6.7
CVE-2023-50692
8.8
1%
Dec 28
File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the…
Affected: 2.5
CVE-2021-29334
8.8
0%
Nov 23
An issue was discovered in JIZHI CMS 1.9.4
Affected: 1.9.4
CVE-2022-44140
8.8
1%
Nov 23
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component
Affected: 2.3.3
CVE-2022-45278
8.8
1%
Nov 23
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component
Affected: 2.3.3
CVE-2022-36577
8.8
0%
Aug 19
An issue was discovered in jizhicms v2.3.1
Affected: 2.3.1
CVE-2019-17593
8.8
0%
Oct 14
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator
Affected: 1.5.1
CVE-2024-33338
7.3
1%
Apr 29
Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request
Affected: 2.5.4
CVE-2025-70397
7.2
0%
Feb 17
jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter
Affected: 2.5.6
CVE-2025-14012
7.2
0%
Dec 4
JIZHICMS Batch Delete Comments deleteAll.html delete sql injection
Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5
CVE-2025-14011
7.2
0%
Dec 4
JIZHICMS Add Display Name Field addcomment.html commentlist sql injection
Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5
CVE-2023-38948
7.2
1%
Aug 3
An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin
Affected: 1.9.5
CVE-2023-27235
7.2
1%
Mar 15
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file
Affected: 2.4.5
CVE-2020-21483
7.2
2%
Sep 15
An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later changed to a PHP file
Affected: 1.5
Showing 15