TI-2026-00834 CVE-2026-1105 · GHSA-6rcf-63m4-v8rw
EasyCMS UserAction.class.php sql injection
Priority HIGH 70
A vulnerability was identified in EasyCMS up to 1.6.
Easycms
Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Easycms records in CISA KEVNo Easycms vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records
TI-2026-03275 CVE-2026-3786 · GHSA-23h5-crhx-4jpw
EasyCMS Request Parameter RbacuserAction.class.php sql injection
Priority MEDIUM 57
A security flaw has been discovered in EasyCMS up to 1.6.
TI-2026-03274 CVE-2026-3785 · GHSA-8w64-x7wq-f592
EasyCMS Request Parameter RbacnodeAction.class.php sql injection
Priority MEDIUM 57
A vulnerability was identified in EasyCMS up to 1.6.
TI-2022-07460 CVE-2022-23358 · GHSA-wwq9-3w37-xj9v
EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php.
Priority MEDIUM 44
EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php.
TI-2020-14862 CVE-2020-24271 · GHSA-wfj8-v9x3-cw4h
A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through…
Priority LOW 39
A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post username=***&password=***.
TI-2019-04481 CVE-2019-6294 · GHSA-6m27-4g36-q4r5
An issue was discovered in EasyCMS 1.5.
Priority LOW 39
An issue was discovered in EasyCMS 1.5.
TI-2018-11709 CVE-2018-16345 · GHSA-wmqj-3p3m-7m45
An issue was discovered in EasyCMS 1.5.
Priority LOW 39
An issue was discovered in EasyCMS 1.5.
TI-2018-09307 CVE-2018-12971 · GHSA-666x-xpwv-64xg
EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.
Priority LOW 29
EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.
TI-2018-12232 CVE-2018-17113 · GHSA-v28m-2f54-wwf7
App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5…
Priority LOW 28
App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter, a related issue to CVE-2018-9173.
TI-2018-11997 CVE-2018-16759 · GHSA-qgvv-r2mj-f75g
The removeXSS function in App/Common/common.php (called from…
Priority LOW 28
The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event.
TI-2018-07345 CVE-2018-10374 · GHSA-4xc6-4jhv-986h
EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an…
Priority LOW 28
EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html request.
TI-2018-12010 CVE-2018-16773 · GHSA-5cq6-j3hg-gxhm
EasyCMS 1.5 allows XSS via the…
Priority LOW 23
EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field.