Threat database

A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialchars_decode of the file /index.php/admins/Sys/addcache.html. The manipulation of the argument sqls results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Jizhicms version 2.5.4 contains a critical SQL injection vulnerability in its product editing module. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is identified as CVE-2025-50229 with a CVSS score of 9.8, indicating a high severity risk. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild at this time.

Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.

JiZhiCMS version 2.5.6 and earlier contains a stored Cross-Site Scripting (XSS) vulnerability in the release function of UserController.php. The vulnerability arises because the application attempts to sanitize input by filtering <script> tags but fails to remove dangerous event handlers such as 'onerror' in other HTML tags like <img>. An authenticated attacker can exploit this by injecting malicious scripts via the 'body' parameter in a POST request to /user/release.html. This can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially compromising user data and session integrity. The CVSS score is 5.4, indicating a medium severity level.

A security vulnerability has been detected in jizhiCMS up to 2.5.6. Affected is the function findAll in the library frphp/lib/Model.php of the component Batch Interface. The manipulation of the argument data leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.php/admins/Comment/addcomment.html of the component Comment Handler. The manipulation of the argument body leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of the file /index.php/admins/Comment/deleteAll.html of the component Batch Delete Comments. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Comment/addcomment.html of the component Add Display Name Field. Performing a manipulation of the argument aid/tid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.

jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function.

Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request.