instantsoft

Records26All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

instantsoft records in CISA KEV

No instantsoft vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Instantcms 1 record LOW

Records

26 records

TI-2023-03877 CVE-2023-4188 · GHSA-h267-xjjf-qgxq

SQL Injection in instantsoft/icms2

HIGH 80

SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00928 Published 2023-08-05 Fixed in 2.16.1-git CWE-89

TI-2024-20589 CVE-2024-31212

SQL injection in index_chart_data action

HIGH 67

InstantCMS is a free and open source content management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00854 Published 2024-04-04 No fix listed CWE-20

TI-2023-04538 CVE-2023-4928 · GHSA-36hm-c3f9-q57c

SQL Injection in instantsoft/icms2

HIGH 67

SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00902 Published 2023-09-13 Fixed in 2.16.1 CWE-89

TI-2025-36697 CVE-2025-59055

InstantCMS vulnerable to Server-Side Request Forgery via package installer

HIGH 65

InstantCMS is a free and open source content management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00454 Published 2025-09-11 No fix listed CWE-918

TI-2023-04291 CVE-2023-4655 · GHSA-5x3r-fvpc-645c

Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

MEDIUM 60

Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00467 Published 2023-08-31 Fixed in 2.16.1 CWE-79

TI-2026-39443 CVE-2026-54611

InstantCMS has Remote Code Execution in package installer

MEDIUM 58

InstantCMS is a free and open source content management system.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00663 Published 2026-09-08 Fixed in 2.18.2 CWE-434

TI-2024-33783 CVE-2024-50348

InstantCMS has a Cross Site Scripting Vulnerability

MEDIUM 58

InstantCMS is a free and open source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00349 Published 2024-10-29 Fixed in 2.16.3 CWE-79

TI-2024-20590 CVE-2024-31213

InstantCMS Open Redirect vulnerability

MEDIUM 58

InstantCMS is a free and open source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00399 Published 2024-04-05 Fixed in 2.16.2 CWE-601

TI-2023-04335 CVE-2023-4704 · GHSA-wwr6-8p5g-fwf7

External Control of System or Configuration Setting in instantsoft/icms2

MEDIUM 58

External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00891 Published 2023-09-01 Fixed in 2.16.1-git CWE-15

TI-2023-04288 CVE-2023-4652 · GHSA-pwh6-38cc-87qf

Cross-site Scripting (XSS) - Stored in instantsoft/icms2

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00506 Published 2023-08-31 Fixed in 2.16.1-git CWE-79

TI-2023-04287 CVE-2023-4651 · GHSA-wrv9-8qw6-67rv

Server-Side Request Forgery (SSRF) in instantsoft/icms2

MEDIUM 58

Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00415 Published 2023-08-31 Fixed in 2.16.1 CWE-918

TI-2023-04285 CVE-2023-4649 · GHSA-v6v4-5w5j-fcq8

Session Fixation in instantsoft/icms2

MEDIUM 58

Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00438 Published 2023-08-31 Fixed in 2.16.1 CWE-384

TI-2026-70556 CVE-2026-108568 · GHSA-p5x9-rh29-4r44

Data authenticity flaw in InstantSoft icms2 PayPal billing

MEDIUM 57

A vulnerability was determined in InstantSoft icms2 up to 2.18.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00133 Published 2026-10-11 No fix listed CWE-345

TI-2026-70555 CVE-2026-108567 · GHSA-2x23-44x6-qv92

Path traversal in InstantSoft icms2 Image Handler

MEDIUM 57

A vulnerability was found in InstantSoft icms2 up to 2.18.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00374 Published 2026-10-11 No fix listed CWE-22

TI-2026-70554 CVE-2026-108566 · GHSA-j944-2cmv-5vxf

Cross-site scripting in InstantSoft icms2 Private Message handler

MEDIUM 56

A vulnerability has been found in InstantSoft icms2 up to 2.18.2.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00241 Published 2026-10-11 No fix listed CWE-79

TI-2023-04289 CVE-2023-4653 · GHSA-wwmp-qg3g-rq8m

Cross-site Scripting (XSS) - Stored in instantsoft/icms2

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00492 Published 2023-08-31 Fixed in 2.16.1-git CWE-79

TI-2023-04286 CVE-2023-4650 · GHSA-vp69-r7gq-xp5p

Improper Access Control in instantsoft/icms2

MEDIUM 55

Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00538 Published 2023-08-31 Fixed in 2.16.1-git CWE-284

TI-2023-03878 CVE-2023-4189 · GHSA-cx85-vw9h-mf4j

Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

MEDIUM 55

Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00473 Published 2023-08-05 Fixed in 2.16.1-git CWE-79

TI-2023-03876 CVE-2023-4187 · GHSA-crx8-5gw7-25m9

Cross-site Scripting (XSS) - Stored in instantsoft/icms2

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00473 Published 2023-08-05 Fixed in 2.16.1-git CWE-79

TI-2023-04290 CVE-2023-4654 · GHSA-9q2q-rv8x-x676

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2

MEDIUM 50

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00339 Published 2023-08-31 Fixed in 2.16.1 CWE-614

TI-2026-35988 CVE-2026-48707

InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning

MEDIUM 48

InstantCMS is a free and open source content management system.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00267 Published 2026-09-08 Fixed in 2.18.2 CWE-918

TI-2013-05628 CVE-2013-6839 · GHSA-85v7-m275-r8jh

SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote…

LOW 35

SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to catalog/[id].

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01212 Published 2013-12-13 No fix listed CWE-89

TI-2026-22590 CVE-2026-28281

InstantCMS has Multiple CSRF Vulnerabilities

LOW 30

InstantCMS is a free and open source content management system.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00152 Published 2026-03-09 Fixed in 2.18.1 CWE-352

TI-2023-04492 CVE-2023-4878 · GHSA-w3hc-fc6c-v6hj

Server-Side Request Forgery (SSRF) in instantsoft/icms2

LOW 25

Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00376 Published 2023-09-10 Fixed in 2.16.1-git CWE-918

TI-2023-04493 CVE-2023-4879 · GHSA-658q-9r9r-h96x

Cross-site Scripting (XSS) - Stored in instantsoft/icms2

LOW 22

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00402 Published 2023-09-10 Fixed in 2.16.1.-git CWE-79

Open these records in search →