Intelliants

Records70All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high18CVSS 7.0–8.9

Exploited now

Intelliants records in CISA KEV

No Intelliants vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Subrion Cms 36 records HIGH Subrion 25 records HIGH Elitius 2 records LOW Esyndicat 2 records LOW

Records

70 records

TI-2024-16725 CVE-2024-25400

Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php.

HIGH 82

Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00659 Published 2024-02-27 No fix listed CWE-89

TI-2023-25347 CVE-2023-46947 · GHSA-2x28-c7j7-23gv

Subrion 4.2.1 has a remote command execution vulnerability in the backend.

HIGH 73

Subrion 4.2.1 has a remote command execution vulnerability in the backend.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01548 Published 2023-11-03 No fix listed CWE-94

TI-2026-63862 CVE-2026-96772 · GHSA-rrfm-jg6p-h6f5

Intelliants Subrion CMS actions.json assign-owner information disclosure

HIGH 70

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00292 Published 2026-09-24 No fix listed CWE-200

TI-2018-13753 CVE-2018-19422 · GHSA-73xj-v6gc-g5p5

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code…

HIGH 67

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.64507 Published 2018-11-21 Fixed in 4.2.2 CWE-434

TI-2026-63863 CVE-2026-96773 · GHSA-26pw-mmq3-vjxx

Intelliants Subrion CMS Login Page login.php authorize redirect

MEDIUM 63

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0025 Published 2026-09-24 No fix listed CWE-601

TI-2025-43172 CVE-2025-70958 · GHSA-9jjm-mc56-3qxv

Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module…

MEDIUM 60

Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00289 Published 2026-02-02 No fix listed CWE-79

TI-2023-23544 CVE-2023-43875 · GHSA-646r-8fcc-p82r

Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS…

MEDIUM 60

Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminuse…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0083 Published 2023-10-19 No fix listed CWE-79

TI-2022-21043 CVE-2022-43121 · GHSA-jrvr-gmqv-hgrh

A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants…

MEDIUM 60

A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tooltip text field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0072 Published 2022-11-09 No fix listed CWE-79

TI-2023-23549 CVE-2023-43884 · GHSA-7vff-rv2f-cj79

A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions…

MEDIUM 58

A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' param…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00464 Published 2023-09-28 No fix listed CWE-79

TI-2023-23514 CVE-2023-43830 · GHSA-q832-2275-rfqh

A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion…

MEDIUM 58

A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum depos…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2023-09-27 No fix listed CWE-79

TI-2023-23513 CVE-2023-43828 · GHSA-4w2j-wj9q-6wpx

A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow…

MEDIUM 58

A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2023-09-27 No fix listed CWE-79

TI-2017-08464 CVE-2017-11444 · GHSA-54w5-rqwx-v5gj

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.

MEDIUM 57

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.13098 Published 2017-07-19 No fix listed CWE-89

TI-2026-10494 CVE-2026-12202 · GHSA-wrcg-234w-hfhq

Intelliants Subrion CMS Blocks Endpoint cross site scripting

MEDIUM 55

A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00214 Published 2026-06-15 No fix listed CWE-79

TI-2025-35369 CVE-2025-56556 · GHSA-h8wv-vv58-468h

An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or…

MEDIUM 53

An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel - to gain escalated privileges in the cont…

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.002 Published 2025-09-11 No fix listed CWE-566

TI-2017-03557 CVE-2017-5543 · GHSA-4j79-4m6q-77vf

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to…

MEDIUM 46

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02031 Published 2017-01-20 Fixed in 4.1.0 CWE-94

TI-2020-13326 CVE-2020-18155 · GHSA-7q44-gfvq-6g93

SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.

MEDIUM 45

SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01338 Published 2021-07-14 No fix listed CWE-89

TI-2017-03923 CVE-2017-6013 · GHSA-4j92-3x57-77mw

Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter.

MEDIUM 45

Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01509 Published 2017-03-27 No fix listed CWE-89

TI-2017-08465 CVE-2017-11445 · GHSA-8g98-32v4-74xj

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.

MEDIUM 44

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01137 Published 2017-07-19 No fix listed CWE-89

TI-2020-13367 CVE-2020-18326 · GHSA-9cc3-5w85-pxvx

Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1…

MEDIUM 42

Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victi…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02243 Published 2022-03-04 No fix listed CWE-352

TI-2021-19389 CVE-2021-43464 · GHSA-g54x-29xv-58h5

A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code…

MEDIUM 41

A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval().

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01415 Published 2022-04-04 No fix listed

TI-2019-05240 CVE-2019-7357 · GHSA-5mh2-82g9-72jv

Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/.

MEDIUM 41

Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0136 Published 2020-11-10 No fix listed CWE-352

TI-2018-14999 CVE-2018-21037 · GHSA-g8j7-w673-4mjp

Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator…

LOW 39

Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00513 Published 2020-03-17 Fixed in 4.2.1 CWE-352

TI-2017-13539 CVE-2017-18366 · GHSA-c939-g732-48r8

Subrion CMS 4.1.5 has CSRF in blog/delete/.

LOW 39

Subrion CMS 4.1.5 has CSRF in blog/delete/.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0065 Published 2019-04-12 Fixed in 4.2.1 CWE-352

TI-2017-11055 CVE-2017-15063 · GHSA-rc94-7v55-wmg6

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0…

LOW 39

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00515 Published 2017-10-06 Fixed in 4.2.0 CWE-352

TI-2017-03976 CVE-2017-6069 · GHSA-8vm8-w94h-5m67

Subrion CMS 4.0.5 has CSRF in admin/blog/add/.

LOW 39

Subrion CMS 4.0.5 has CSRF in admin/blog/add/.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00723 Published 2017-03-27 No fix listed CWE-352

Open these records in search →