Onekeyadmin is a narrowly scoped administrative platform with a concentrated vulnerability footprint centered on its core product. The vendor's disclosures skew toward serious severity outcomes and recur through application-layer weakness classes including cross-site scripting, improper file and directory access controls, missing authorization checks, and unrestricted file uploads—patterns typical of web-facing administrative interfaces where input handling and access boundaries matter critically to security. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Onekeyadmin over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-26957CRITICAL onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins. | Mar 9, 2023 | 9.1 | 28 | NO | NO |
CVE-2023-26948HIGH onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download. | Mar 9, 2023 | 7.5 | 24 | NO | NO |
CVE-2023-26949CRITICAL An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHP file. | Mar 6, 2023 | 9.8 | 24 | NO | NO |
CVE-2023-26956HIGH onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code. | Mar 8, 2023 | 7.5 | 23 | NO | NO |
CVE-2023-26952MEDIUM onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module. | Mar 8, 2023 | 5.4 | 20 | NO | NO |
CVE-2023-26950MEDIUM onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Categories module. | Mar 8, 2023 | 5.4 | 19 | NO | NO |
CVE-2023-26954MEDIUM onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module. | Mar 7, 2023 | 5.4 | 19 | NO | NO |
CVE-2023-26953MEDIUM onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module. | Mar 7, 2023 | 4.8 | 18 | NO | NO |
CVE-2023-26951MEDIUM onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module. | Mar 16, 2023 | 5.4 | 15 | NO | NO |
CVE-2023-26955MEDIUM onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin Group module. | Mar 7, 2023 | 5.4 | 15 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Onekeyadmin.
Media articles that mention a CVE ID that affects a product developed by Onekeyadmin — matched by CVE ID, not by vendor name.