Priority HIGH 82
iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01091 · Published 2022-10-13 · No fix listed CWE-918
Priority MEDIUM 60
iCMS v8.0.0 contains a Cross-Site Scripting (XSS) vulnerability in the User Management component, specifically within the index.html file.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00213 · Published 2026-03-24 · No fix listed CWE-79
Priority MEDIUM 56
A vulnerability was detected in iCMS up to 8.0.0.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.0048 · Published 2025-12-31 · No fix listed CWE-74
Priority MEDIUM 50
iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00607 · Published 2023-08-10 · No fix listed CWE-89
Priority MEDIUM 50
iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00607 · Published 2023-08-10 · No fix listed CWE-89
Priority MEDIUM 48
idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile p…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03354 · Published 2019-01-29 · No fix listed CWE-22
Priority MEDIUM 46
iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02166 · Published 2022-02-04 · No fix listed CWE-94
Priority MEDIUM 45
iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME parameter to install/install.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01552 · Published 2020-12-10 · No fix listed CWE-78
Priority MEDIUM 45
iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01552 · Published 2020-12-10 · No fix listed CWE-78
Priority MEDIUM 44
Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()" method of the component "database.admincp.php".
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02218 · Published 2021-04-29 · No fix listed CWE-22
Priority MEDIUM 44
An issue was discovered in idreamsoft iCMS v7.0.14.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01095 · Published 2019-10-14 · No fix listed CWE-89
Priority MEDIUM 44
An issue was discovered in idreamsoft iCMS 7.0.13.
CVSS 3.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02231 · Published 2019-01-30 · No fix listed CWE-22
Priority MEDIUM 40
icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00274 · Published 2023-09-08 · No fix listed CWE-352
Priority LOW 39
A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00518 · Published 2021-05-28 · No fix listed CWE-352
Priority LOW 39
iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00554 · Published 2021-11-12 · No fix listed CWE-352
Priority LOW 39
An issue was discovered in idreamsoft iCMS V7.0.10.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00614 · Published 2018-09-02 · No fix listed CWE-352
Priority LOW 39
An issue was discovered in idreamsoft iCMS V7.0.10.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00614 · Published 2018-09-02 · No fix listed CWE-352
Priority LOW 39
An issue was discovered in iCMS 7.0.9.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00614 · Published 2018-09-02 · No fix listed CWE-352
Priority LOW 38
An issue was discovered in idreamsoft iCMS 7.0.13.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02476 · Published 2019-01-30 · No fix listed CWE-22
Priority LOW 37
An issue was discovered in idreamsoft iCMS 7.0.13 on Windows.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02247 · Published 2019-01-30 · No fix listed CWE-22
Priority LOW 37
An issue was discovered in idreamsoft iCMS 7.0.13.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02247 · Published 2019-01-30 · No fix listed CWE-22
Priority LOW 36
In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01607 · Published 2022-02-04 · No fix listed CWE-22
Priority LOW 36
idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file.
CVSS 3.0HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02435 · Published 2018-09-01 · No fix listed CWE-22
Priority LOW 35
idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large posi…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01259 · Published 2019-10-14 · No fix listed CWE-770
Priority LOW 29
A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00402 · Published 2020-09-10 · No fix listed CWE-352
Load more
THREATIST.IORead the docs