Phome

Records17All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

Phome records in CISA KEV

No Phome vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Empirecms 17 records HIGH

Records

17 records

TI-2025-14066 CVE-2025-15422 · GHSA-2223-q26h-rqmg

EmpireSoft EmpireCMS IP Address connect.php egetip protection mechanism

HIGH 70

A flaw has been found in EmpireSoft EmpireCMS up to 8.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01266 Published 2026-01-02 No fix listed CWE-693

TI-2023-27405 CVE-2023-50162 · GHSA-vqqj-jrgg-4rq8

SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute…

HIGH 67

SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the DoExecSql function.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0098 Published 2024-01-08 No fix listed CWE-89

TI-2025-14067 CVE-2025-15423 · GHSA-p2h8-g3qw-gm52

EmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted upload

MEDIUM 57

A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00366 Published 2026-01-02 No fix listed CWE-284

TI-2018-13369 CVE-2018-18869 · GHSA-4vx5-4pfx-2jm6

EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F…

MEDIUM 48

EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03741 Published 2018-10-31 No fix listed CWE-22

TI-2020-14423 CVE-2020-22937 · GHSA-f8j7-34r5-rv6c

A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to…

MEDIUM 47

A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0282 Published 2021-08-17 No fix listed CWE-94

TI-2018-14362 CVE-2018-20300 · GHSA-cwhf-vqf3-q732

Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp…

MEDIUM 45

Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01577 Published 2018-12-20 No fix listed CWE-94

TI-2022-11245 CVE-2022-28585 · GHSA-4r54-p7h8-fw6x

EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php

MEDIUM 44

EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00956 Published 2022-05-03 No fix listed CWE-89

TI-2018-12851 CVE-2018-18086 · GHSA-j396-rrg7-mw2x

EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in…

MEDIUM 41

EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01493 Published 2018-10-09 No fix listed CWE-434

TI-2018-13048 CVE-2018-18449 · GHSA-82gr-g8r8-2vh3

EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to…

LOW 39

EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0065 Published 2019-03-07 No fix listed CWE-352

TI-2018-11705 CVE-2018-16339 · GHSA-8fqv-93g6-24c7

An issue was discovered in EmpireCMS 7.0.

LOW 39

An issue was discovered in EmpireCMS 7.0.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00523 Published 2018-09-02 No fix listed CWE-352

TI-2018-13782 CVE-2018-19462 · GHSA-m6qm-rc68-729q

admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary…

LOW 36

admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02169 Published 2019-06-07 No fix listed CWE-89

TI-2012-04820 CVE-2012-5777 · GHSA-3jpp-jwvr-524v

Eval injection vulnerability in the ReplaceListVars function in the template parser in…

LOW 34

Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackers to execute arbitrary PHP code via a crafted template.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02211 Published 2012-11-16 No fix listed CWE-94

TI-2019-09212 CVE-2019-12362 · GHSA-cwx3-h7cf-3jpw

EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.

LOW 29

EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00826 Published 2019-05-27 No fix listed CWE-79

TI-2018-05027 CVE-2018-6881 · GHSA-fc36-cvc7-f5jj

EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a…

LOW 28

EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02229 Published 2018-02-12 No fix listed CWE-200

TI-2018-05026 CVE-2018-6880 · GHSA-qpwj-fcq8-gvwh

EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array…

LOW 28

EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01789 Published 2018-02-12 No fix listed CWE-668

TI-2019-09211 CVE-2019-12361 · GHSA-3g6f-gvxf-2qx6

EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated…

LOW 27

EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00413 Published 2019-05-27 No fix listed CWE-352

TI-2018-13781 CVE-2018-19461 · GHSA-f2vw-37xv-2cxr

admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.

LOW 24

admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00915 Published 2019-06-07 No fix listed CWE-79

Open these records in search →

Critical	4
High	5
Medium	8
Low	0
No CVSS	0