CouchCMS

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

CouchCMS records in CISA KEV

No CouchCMS vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Couchcms 4 records HIGH Couch 1 record MEDIUM

Records

4 records in Couchcms · all components

TI-2026-23173 CVE-2026-29002 · GHSA-6g6q-gcm9-395j

CouchCMS Privilege Escalation via f_k_levels_list Parameter

HIGH 72

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00443 Published 2026-04-10 No fix listed CWE-639

TI-2025-13688 CVE-2025-15005 · GHSA-7v96-f75p-x544

CouchCMS reCAPTCHA config.example.php hard-coded key

MEDIUM 61

A security flaw has been discovered in CouchCMS up to 2.4.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00462 Published 2025-12-22 No fix listed CWE-320

TI-2023-22047 CVE-2023-41609 · GHSA-xgrq-27cp-45v2

An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows…

MEDIUM 60

An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0041 Published 2023-09-11 No fix listed CWE-601

TI-2025-41101 CVE-2025-67004 · GHSA-9w9h-4qfh-f6m6

Disputed An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin…

LOW 38

** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.06121 Published 2026-01-09 No fix listed CWE-22

Open these records in search →

Critical	0
High	1
Medium	6
Low	0
No CVSS	0