Threats affecting pkg:github/xiweicheng/TMS

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	4.8	EPSS 0.3%	CVE-2025-14801xiweicheng TMS · Cross-site Scripting Medium4.8EPSS 0.3%2025-12-17CVE Database V5CVE-2025-14801 A security vulnerability has been detected in xiweicheng TMS up to 2.28.0. This affects the function createComment of the file /admin/blog/comment/create. Such manipulation of the argument content leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. EPSS 0.3%Vulnerability	CVE Database V5	2025-12-17
High	8.1	EPSS 0.7%	CVE-2024-32256tms · Unrestricted File Upload High8.1EPSS 0.7%2024-04-16CVE Database V5CVE-2024-32256 Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. When updating a current package, there are no checks for what types of files are uploaded from the image. EPSS 0.7%Vulnerability CWE-434	CVE Database V5	2024-04-16

Page 1 of 1