Taogogo maintains a narrowly focused portfolio centered on TaoCMS, a content-management system whose vulnerability footprint, despite modest product scope, sits among the more prominent in the landscape. The vendor's disclosures skew strongly toward critical-severity outcomes, reflecting a recurrent pattern of structural weaknesses in input handling and access control across the application. The exposure concentrates in a consistent set of weakness classes including SQL injection, code injection, path traversal, cross-site scripting, and improper file/directory access controls—all characteristic of web-application architecture where user input interacts directly with backend execution and file-system boundaries. Defenders relying on TaoCMS should treat advisories as high-priority and apply patches promptly to mitigate the severity tendency of this vendor's disclosures. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Taogogo over time
Signals from CVEs in this vendor scope (25 CVEs).
25 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-25578CRITICAL taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file. | Mar 18, 2022 | 9.8 | 34 | NO | NO |
CVE-2022-36262CRITICAL An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php. | Aug 15, 2022 | 9.8 | 32 | NO | NO |
CVE-2023-1947CRITICAL A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation leads to code injectio | Apr 7, 2023 | 9.8 | 31 | NO | NO |
CVE-2022-46998CRITICAL An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF). | Jan 26, 2023 | 9.8 | 31 | NO | NO |
CVE-2022-48006CRITICAL An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploited via manipulation of the u | Jan 30, 2023 | 9.8 | 30 | NO | NO |
CVE-2022-23880CRITICAL An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. | Mar 23, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-25505CRITICAL Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.php. | Mar 21, 2022 | 9.8 | 30 | NO | NO |
CVE-2021-46204CRITICAL Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter. SQL injection vulnerability via taocms\include\Model\Article.php. | Jan 19, 2022 | 9.8 | 30 | NO | NO |
CVE-2021-45014CRITICAL There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&id=26 | Dec 14, 2021 | 9.8 | 30 | NO | NO |
CVE-2021-45015CRITICAL taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72. | Dec 14, 2021 | 9.1 | 28 | NO | NO |
Signals from CVEs in this vendor scope (25 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Taogogo.
Media articles that mention a CVE ID that affects a product developed by Taogogo — matched by CVE ID, not by vendor name.