Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2022-39298

Deserialization of untrusted data in MelisFront

MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewritting, search optimization and SEO, etc. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-front`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-front` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.

CVSS 3.1 · 7.7 High EPSS 1.3% KEV · Not listed
Vendors
Melistechnology
Products
Meliscms
CVE-2022-39297

Deserialization of untrusted data in MelisCms

MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.

CVSS 3.1 · 7.7 High EPSS 1.3% KEV · Not listed
Vendors
Melistechnology
Products
Meliscms
CVE-2025-10352

Missing Authorization vulnerability in Melis Platform

Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Melistechnology
Products
Melis Platform
CVE-2025-10351

SQL injection vulnerability in Melis Platform

SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Melistechnology
Products
Melis Platform
CVE-2025-10353

Missing Authorization vulnerability in Melis Platform

File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.

CVSS 4.0 · 9.3 Critical EPSS 2.7% KEV · Not listed
Vendors
Melistechnology
Products
Melis Platform
CVE-2022-39296

Path traversal in MelisAssetManager

MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of `melisplatform/melis-asset-manager`, leading to the disclosure of sensitive information. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-asset-manager` >= 5.0.1. This issue was addressed by restricting access to files to intended directories only.

CVSS 3.1 · 8.6 High EPSS 1.9% KEV · Not listed
Vendors
Melistechnology
Products
Melis-asset-manager