Ocportal is a web-based portal and content-management platform whose vulnerability profile concentrates in a single product and is characterized by recurrent input-handling issues spanning cross-site scripting, improper input validation, and path-traversal flaws typical of web applications. The vendor's disclosed vulnerabilities frequently acquire public exploit code, reflecting the accessibility and appeal of web-application weaknesses to security researchers and tool developers. Defenders deploying Ocportal should prioritize input-sanitization review and restrict file-system access; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ocportal over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2004-1592HIGH PHP remote file inclusion vulnerability in index.php in ocPortal 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the req_path parameter to refe | Dec 31, 2004 | 7.5 | 29 | NO | YES |
CVE-2012-1470MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2 | Oct 1, 2012 | 4.3 | 25 | NO | YES |
CVE-2012-5234MEDIUM Open redirect vulnerability in index.php in ocPortal before 7.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the red | Oct 1, 2012 | 5.8 | 19 | NO | NO |
CVE-2015-9549MEDIUM A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF_EMOTICON_CELL.tpl FIELD_NAME field to data/emoticons.php. | Aug 3, 2020 | 6.1 | 17 | NO | NO |
CVE-2012-1471MEDIUM Directory traversal vulnerability in catalogue_file.php in ocPortal before 7.1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. | Oct 1, 2012 | 5.0 | 17 | NO | NO |
Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the (1) title or (2) text | Mar 23, 2015 | 3.5 | 13 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ocportal.
Media articles that mention a CVE ID that affects a product developed by Ocportal — matched by CVE ID, not by vendor name.