Threat database

11 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.1	EPSS 0.2%	CVE-2024-41305WonderCMS · n/a High7.1EPSS 0.2%2024-07-30CVE Database V5CVE-2024-41305 A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter. EPSS 0.2%Vulnerability	CVE Database V5	2024-07-30
Medium	4.6	EPSS 0.5%	CVE-2024-32746wondercms · n/a Medium4.6EPSS 0.5%2024-04-17CVE Database V5CVE-2024-32746 A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the MENU parameter under the Menu module. EPSS 0.5%Vulnerability	CVE Database V5	2024-04-17
Medium	5.9	EPSS 0.3%	CVE-2024-32745wondercms · n/a Medium5.9EPSS 0.3%2024-04-17CVE Database V5CVE-2024-32745 A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE DESCRIPTION parameter under the CURRENT PAGE module. EPSS 0.3%Vulnerability	CVE Database V5	2024-04-17
Medium	4.6	EPSS 0.4%	CVE-2024-32744wondercms · n/a Medium4.6EPSS 0.4%2024-04-17CVE Database V5CVE-2024-32744 A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE KEYWORDS parameter under the CURRENT PAGE module. EPSS 0.4%Vulnerability	CVE Database V5	2024-04-17
Medium	5.5	EPSS 0.4%	CVE-2024-32743wondercms · n/a Medium5.5EPSS 0.4%2024-04-17CVE Database V5CVE-2024-32743 A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SITE LANGUAGE CONFIG parameter under the Security module. EPSS 0.4%Vulnerability	CVE Database V5	2024-04-17
Critical	9.6	EPSS 0.7%	CVE-2024-32340wondercms · n/a Critical9.6EPSS 0.7%2024-04-17CVE Database V5CVE-2024-32340 A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the Menu module. EPSS 0.7%Vulnerability	CVE Database V5	2024-04-17
Medium	6.1	EPSS 0.4%	CVE-2024-32339wondercms · n/a Medium6.1EPSS 0.4%2024-04-17CVE Database V5CVE-2024-32339 Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters. EPSS 0.4%Vulnerability	CVE Database V5	2024-04-17
Medium	5.4	EPSS 0.4%	CVE-2024-32338wondercms · n/a Medium5.4EPSS 0.4%2024-04-17CVE Database V5CVE-2024-32338 A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE TITLE parameter under the Current Page module. EPSS 0.4%Vulnerability	CVE Database V5	2024-04-17
Medium	6.1	EPSS 0.4%	CVE-2024-32337wondercms · n/a Medium6.1EPSS 0.4%2024-04-17CVE Database V5CVE-2024-32337 A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ADMIN LOGIN URL parameter under the Security module. EPSS 0.4%Vulnerability	CVE Database V5	2024-04-17
Medium	6.5	EPSS 0.4%	CVE-2024-27563WonderCMS · n/a Medium6.5EPSS 0.4%2024-03-05CVE Database V5CVE-2024-27563 A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter. EPSS 0.4%Vulnerability	CVE Database V5	2024-03-05
Critical	9.1	EPSS 0.6%	CVE-2024-27561WonderCMS · n/a Critical9.1EPSS 0.6%2024-03-05CVE Database V5CVE-2024-27561 A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the installThemePlugin parameter. EPSS 0.6%Vulnerability	CVE Database V5	2024-03-05

Page 1 of 1