Wondercms
Wondercms: vulnerabilidades y CVE
Wondercms tiene 37 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 5 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE37
Últimos 12 meses1
Críticas5
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-58305 | Alta (8.6) | 0.43% | — | 12 dic 2025 | WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to… |
| CVE-2025-57055 | Media (6.5) | 0.41% | — | 17 sept 2025 | WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The… |
| CVE-2025-3123 | Media (5.1) | 0.57% | — | 2 abr 2025 | A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The… |
| CVE-2024-41305 | Media (4.7) | 0.19% | — | 30 jul 2024 | A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter. |
| CVE-2024-41304 | Media (5.4) | 0.36% | — | 30 jul 2024 | An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file. |
| CVE-2024-32746 | Media (4.6) | 0.45% | — | 17 abr 2024 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the MENU parameter under the Menu… |
| CVE-2024-32745 | Media (5.9) | 0.32% | — | 17 abr 2024 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE DESCRIPTION parameter under… |
| CVE-2024-32744 | Media (4.6) | 0.40% | — | 17 abr 2024 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE KEYWORDS parameter under the… |
| CVE-2024-32743 | Media (5.5) | 0.40% | — | 17 abr 2024 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SITE LANGUAGE CONFIG parameter… |
| CVE-2024-32341 | Media (5.4) | 0.39% | — | 17 abr 2024 | Multiple cross-site scripting (XSS) vulnerabilities in the Home page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters. |
| CVE-2024-32340 | Crítica (9.6) | 0.71% | — | 17 abr 2024 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the… |
| CVE-2024-32339 | Media (6.1) | 0.40% | — | 17 abr 2024 | Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters. |
| CVE-2024-32338 | Media (5.4) | 0.40% | — | 17 abr 2024 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE TITLE parameter under the… |
| CVE-2024-32337 | Media (6.1) | 0.43% | — | 17 abr 2024 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ADMIN LOGIN URL parameter under… |
| CVE-2024-27563 | Media (5.3) | 0.42% | — | 5 mar 2024 | A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl… |
| CVE-2024-27561 | Alta (8.1) | 0.58% | — | 5 mar 2024 | A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the… |
| CVE-2023-41425 | Media (6.1) | 54% | — | 7 nov 2023 | Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. |
| CVE-2022-43332 | Media (6.1) | 0.59% | — | 17 nov 2022 | A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel. |
| CVE-2020-35314 | Crítica (9.8) | 27% | — | 20 abr 2021 | A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a… |
| CVE-2020-35313 | Crítica (9.8) | 45% | — | 20 abr 2021 | A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin… |
| CVE-2020-29469 | Media (5.4) | 1.4% | — | 30 dic 2020 | WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website… |
| CVE-2020-29233 | Media (5.4) | 1.3% | — | 30 dic 2020 | WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allow an attacker to inject the XSS payload in the Page description and each time any user will visits… |
| CVE-2020-29247 | Media (4.8) | 0.80% | — | 24 dic 2020 | WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can… |
| CVE-2019-5956 | Media (6.5) | 1.9% | — | 12 sept 2019 | Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors. |
| CVE-2018-14387 | Alta (8.8) | 1.6% | — | 18 jul 2018 | An issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web application and record the associated session identifier. The attacker then causes the victim to authenticate against the… |
| CVE-2018-7172 | Media (4.9) | 2.6% | — | 27 feb 2018 | In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal. |
| CVE-2018-1000062 | Media (4.4) | 0.58% | — | 9 feb 2018 | WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction(), 'svg' => 'image/svg+xml' that can result in An attacker can execute arbitrary script on an… |
| CVE-2017-14523 | Alta (7.5) | 8.0% | — | 26 ene 2018 | WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local… |
| CVE-2017-14522 | Media (6.1) | 1.2% | — | 26 ene 2018 | In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a… |
| CVE-2017-14521 | Alta (8.8) | 7.3% | — | 26 ene 2018 | In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.