Priority HIGH 82
cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01072 · Published 2023-06-15 · No fix listed CWE-22
Priority HIGH 75
A vulnerability was found in CmsEasy up to 7.7.7.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00709 · Published 2024-01-14 · No fix listed CWE-89
Priority HIGH 72
Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00687 · Published 2024-04-26 · No fix listed CWE-26
Priority HIGH 72
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00365 · Published 2023-06-27 · No fix listed CWE-522
Priority HIGH 66
CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template_admin.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00446 · Published 2024-05-07 · No fix listed CWE-98
Priority MEDIUM 64
CMSeasy 7.7.7.9 is vulnerable to code execution.
CVSS 3.1MEDIUM 6.4· Local · High privileges · No interaction · EPSS 0.00322 · Published 2024-04-17 · No fix listed CWE-22
Priority MEDIUM 61
CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00222 · Published 2025-09-19 · No fix listed CWE-459
Priority MEDIUM 57
A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.01033 · Published 2025-02-16 · No fix listed CWE-22
Priority MEDIUM 57
A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.0094 · Published 2025-02-16 · No fix listed CWE-22
Priority MEDIUM 57
A vulnerability classified as critical has been found in CmsEasy 7.7.7.9.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00981 · Published 2025-02-07 · No fix listed CWE-22
Priority MEDIUM 57
A vulnerability classified as critical was found in CmsEasy 7.7.7.9.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00855 · Published 2025-02-03 · No fix listed CWE-22
Priority MEDIUM 56
A flaw has been found in CmsEasy up to 7.7.7.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00481 · Published 2025-12-28 · No fix listed CWE-74
Priority MEDIUM 56
A vulnerability was determined in CmsEasy up to 7.7.7.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00303 · Published 2025-10-06 · No fix listed CWE-79
Priority MEDIUM 56
cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00614 · Published 2024-02-22 · No fix listed CWE-27
Priority MEDIUM 53
CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.004 · Published 2024-04-17 · No fix listed CWE-791
Priority MEDIUM 50
An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component.
CVSS 3.1LOW 3.5· Adjacent network · Low privileges · No interaction · EPSS 0.00411 · Published 2024-04-25 · No fix listed CWE-922
Priority MEDIUM 42
cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01752 · Published 2022-05-17 · No fix listed CWE-22
Priority MEDIUM 40
CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/template_admin.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0067 · Published 2024-05-07 · No fix listed CWE-22
Priority LOW 39
An issue was discovered in CmsEasy 6.1_20180508.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.0053 · Published 2018-06-02 · No fix listed CWE-352
Priority LOW 31
cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00982 · Published 2022-05-17 · No fix listed CWE-552
Priority LOW 29
In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00752 · Published 2019-02-18 · No fix listed CWE-79
Priority LOW 29
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00752 · Published 2019-02-18 · No fix listed CWE-79
Priority LOW 29
An issue was discovered in CmsEasy 6.1_20180508.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0041 · Published 2018-06-02 · No fix listed CWE-352
THREATIST.IORead the docs