Timgreen maintains a small portfolio of web-based content management and educational software, including Dingfanzu CMS and Python Book, that appears prominently relative to its size in the vulnerability landscape. The vendor's disclosures skew toward serious outcomes, with a notable share reaching critical severity, and recur through application-layer weakness classes including cross-site request forgery, path traversal, and authorization flaws that are characteristic of web platforms. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Timgreen over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-50649CRITICAL The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability. | Nov 15, 2024 | 9.8 | 26 | NO | NO |
CVE-2024-50966CRITICAL dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin. | Nov 8, 2024 | 9.3 | 25 | NO | NO |
CVE-2024-50650HIGH python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter. | Nov 15, 2024 | 7.5 | 21 | NO | NO |
CVE-2024-48291MEDIUM dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAdmin&id=17 | Oct 28, 2024 | 6.3 | 19 | NO | NO |
CVE-2024-48191MEDIUM dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=delAdmin&id=17 | Oct 28, 2024 | 6.3 | 19 | NO | NO |
CVE-2024-48758MEDIUM dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the addPro parameter of the component doAdminAction.php which allows a remote attacker to execu | Oct 16, 2024 | 6.1 | 19 | NO | NO |
CVE-2024-46485MEDIUM dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=addCate | Sep 25, 2024 | 6.3 | 19 | NO | NO |
CVE-2024-46600MEDIUM dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/doAdminAction.php?act=delCate&id=31 | Sep 25, 2024 | 4.7 | 16 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Timgreen.
Media articles that mention a CVE ID that affects a product developed by Timgreen — matched by CVE ID, not by vendor name.