jizhicms has 3 CVEs on record between 2021 and 2026. The median CVSS is 9.1 (critical), with 2 rated critical.
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
3
Total CVEs
2
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2025-50229Critical· 9.8Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.54CVE-2025-50228Critical· 9.1Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.50CVE-2020-21228Medium· 6.1JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.34
jizhicms vulnerabilities
CVEs affecting jizhicms, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2025-50229Critical· 9.8Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.
Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.
▾ Midnightjizhicms · jizhicmsEPSS 0.36%via NVD
CVE-2025-50228Critical· 9.1Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.
Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.
▾ Midnightjizhicms · jizhicmsEPSS 0.27%via NVD
CVE-2020-21228Medium· 6.1JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.
▾ Sunlitjizhicms · jizhicmsEPSS 0.81%via NVD