Pyrocms

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Pyrocms records in CISA KEV

No Pyrocms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pyrocms 6 records HIGH

Records

6 records

TI-2023-13964 CVE-2023-29689 · GHSA-w7vm-4v3j-vgpw

PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited…

HIGH 82

PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.53463 Published 2023-08-04 No fix listed

TI-2024-38394 CVE-2024-58297 · GHSA-5gm4-757j-3p92

PyroCMS v3.0.1 Stored Cross-Site Scripting via Admin Redirects

MEDIUM 57

PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00256 Published 2025-12-11 No fix listed CWE-79

TI-2022-17541 CVE-2022-37721 · GHSA-cm7f-hf2g-ghrp

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged…

MEDIUM 42

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privi…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00769 Published 2022-11-25 No fix listed CWE-79

TI-2020-15498 CVE-2020-25263 · GHSA-vg2g-698h-v9w3

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the…

LOW 32

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary plugin will be deleted.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00599 Published 2020-10-08 No fix listed CWE-352

TI-2022-15847 CVE-2022-35118 · GHSA-9725-wqpv-8rxj

PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

LOW 28

PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00526 Published 2022-08-01 No fix listed CWE-79

TI-2020-15497 CVE-2020-25262 · GHSA-56xx-pv88-2662

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

LOW 21

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00526 Published 2020-10-08 No fix listed CWE-352

Open these records in search →

Critical	2
High	1
Medium	3
Low	0
No CVSS	0