Thinkcmf is a modestly represented content-management framework whose vulnerability footprint concentrates in its core products, thinkcmf and thinkcmfx, which serve as the foundation for website and application deployments. The vendor's disclosures skew toward serious outcomes and a meaningful tendency toward public exploit availability, with the durable signal centered on web-application input-handling and access-control weaknesses: SQL injection, code injection, cross-site scripting, cross-site request forgery, and forced browsing. Defenders should treat updates to this framework as moderately urgent, particularly where the CMS is internet-facing or handles user input; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Thinkcmf over time
Signals from CVEs in this vendor scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-20601CRITICAL An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet. | Dec 22, 2021 | 9.8 | 45 | NO | YES |
CVE-2019-6713CRITICAL app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to i | Jan 23, 2019 | 9.8 | 31 | NO | NO |
CVE-2019-7580HIGH ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote chara | Feb 7, 2019 | 8.8 | 30 | NO | NO |
CVE-2022-40489HIGH ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users. | Dec 1, 2022 | 8.8 | 27 | NO | NO |
CVE-2018-19898HIGH ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users via the post[id][1] parameter in an artic | Dec 6, 2018 | 8.8 | 27 | NO | NO |
CVE-2024-31615CRITICAL ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php. | Apr 25, 2024 | 9.8 | 26 | NO | NO |
CVE-2018-19897HIGH ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter | Dec 6, 2018 | 7.2 | 23 | NO | NO |
CVE-2018-19896HIGH ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] parameter in a slide action. | Dec 6, 2018 | 7.2 | 23 | NO | NO |
CVE-2018-19895HIGH ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the parentid parameter in a nav action. | Dec 6, 2018 | 7.2 | 23 | NO | NO |
CVE-2018-19894HIGH ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter i | Dec 6, 2018 | 7.2 | 23 | NO | NO |
Signals from CVEs in this vendor scope (15 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Thinkcmf.
Media articles that mention a CVE ID that affects a product developed by Thinkcmf — matched by CVE ID, not by vendor name.