1000mz
1000mz Chestnutcms: vulnerabilidades y CVE
1000mz Chestnutcms tiene 12 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE12
Últimos 12 meses4
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-36458 | Crítica (9.8) | 0.50% | — | 7 may 2026 | ChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend and injected into a SQL query when the template is rendered. |
| CVE-2025-70073 | Alta (7.2) | 0.68% | — | 5 feb 2026 | An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function |
| CVE-2025-15009 | Baja (2.1) | 0.35% | — | 22 dic 2025 | A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation… |
| CVE-2025-12923 | Baja (2) | 0.57% | — | 10 nov 2025 | A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to… |
| CVE-2025-5552 | Media (5.3) | 0.48% | — | 4 jun 2025 | A vulnerability was found in ChestnutCMS up to 15.1. It has been declared as critical. This vulnerability affects unknown code of the file /dev-api/groovy/exec of the component API Endpoint. The manipulation leads to… |
| CVE-2025-2917 | Media (5.3) | 0.80% | — | 28 mar 2025 | A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/read. The manipulation of the argument filePath leads to path… |
| CVE-2025-2032 | Media (5.1) | 0.51% | — | 6 mar 2025 | A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal.… |
| CVE-2025-2031 | Media (5.3) | 0.35% | — | 6 mar 2025 | A vulnerability classified as critical has been found in ChestnutCMS up to 1.5.2. This affects the function uploadFile of the file /dev-api/cms/file/upload. The manipulation of the argument file leads to unrestricted… |
| CVE-2024-57451 | Alta (7.5) | 0.87% | — | 3 feb 2025 | ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory. |
| CVE-2024-57452 | Alta (7.5) | 0.39% | — | 3 feb 2025 | ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder. |
| CVE-2024-57450 | Crítica (9.8) | 0.56% | — | 3 feb 2025 | ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function. |
| CVE-2024-56828 | Crítica (9.8) | 0.88% | — | 6 ene 2025 | File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.