Cxuu maintains a focused content-management system product that, while narrowly scoped, appears in environments where web-facing application functionality is critical. The recurring vulnerability surface centers on application-layer input handling: cross-site scripting, SQL injection, and cross-site request forgery—all characteristic of web application codebases that handle user-supplied data and session management. Public exploit code has frequently become available for vulnerabilities affecting this product, making timely patching operationally necessary for deployments. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cxuu over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-28091HIGH cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php. | Nov 18, 2020 | 7.5 | 33 | NO | YES |
CVE-2021-3264HIGH SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php. | Aug 27, 2021 | 7.2 | 23 | NO | NO |
CVE-2021-42970MEDIUM Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter. | Mar 29, 2022 | 6.1 | 21 | NO | NO |
CVE-2021-39599MEDIUM Multiple Cross Site Scripting (XSS) vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in (1) public/search.php and in the (2) c parameter in admin.php. | Aug 23, 2021 | 6.1 | 21 | NO | NO |
CVE-2020-35347MEDIUM CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add. | Dec 26, 2020 | 6.5 | 21 | NO | NO |
CVE-2020-29250MEDIUM CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php. | Dec 27, 2020 | 6.1 | 20 | NO | NO |
CVE-2020-29249MEDIUM CXUUCMS V3 allows class="layui-input" XSS. | Dec 27, 2020 | 6.1 | 20 | NO | NO |
CVE-2020-35346MEDIUM CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=ad | Dec 26, 2020 | 4.8 | 19 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cxuu.
Media articles that mention a CVE ID that affects a product developed by Cxuu — matched by CVE ID, not by vendor name.