What’s Vulnerable › Products

Dromara UJCMS vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your Dromara UJCMS version is affected

Latest Dromara UJCMS vulnerabilities

• CVE-2026-93961 — Dromara UJCMS UserController UserController.java usernameExist improper authorization (CVSS 5.3)
• CVE-2026-78140 — Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine (CVSS 4.7)
• CVE-2026-2954 — Dromara UJCMS ImportDataController import-channel importChanel injection (CVSS 9.8)
• CVE-2026-2953 — Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal (CVSS 9.1)
• CVE-2025-2491 — Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting (CVSS 5.4)
• CVE-2025-2490 — Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting (CVSS 5.4)
• CVE-2024-55452 — (CVSS 5.4)
• CVE-2024-55451 — (CVSS 4.8)
• CVE-2024-12483 — Dromara UJCMS User ID id authorization (CVSS 5.9)
• CVE-2023-51806 — (CVSS 5.4)
• CVE-2023-51350 — (CVSS 9.8)
• CVE-2023-34878 — (CVSS 7.5)
• CVE-2023-34865 — (CVSS 9.8)
• CVE-2023-34747 — (CVSS 9.8)
• CVE-2023-3231 — UJCMS ZIP Package information disclosure (CVSS 6.5)
• CVE-2023-24369 — (CVSS 6.1)