Read the docs
TI-2010-04020 Aliases CVE-2010-4271GHSA-hh8r-mv36-fgxg

SQL injection vulnerability in ImpressCMS before 1.2.3 RC2 allows remote attackers to…

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection vulnerability in ImpressCMS before 1.2.3 RC2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Why it matters now

EPSS 0.01063 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 33

CPEVersionsRoleVendor
cpe:2.3:a:impresscms:impresscms:*:rc1:*:*:*:*:*:*up to 1.2.3VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.0:beta1:*:*:*:*:*:*1.0 beta1VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.0:beta2:*:*:*:*:*:*1.0 beta2VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.0:final:*:*:*:*:*:*1.0 finalVulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.0:rc1:*:*:*:*:*:*1.0 rc1VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.0:rc2:*:*:*:*:*:*1.0 rc2VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.0:rc3:*:*:*:*:*:*1.0 rc3VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1:alpha1:*:*:*:*:*:*1.1 alpha1VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1:alpha2:*:*:*:*:*:*1.1 alpha2VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1:beta1:*:*:*:*:*:*1.1 beta1VulnerableImpressCMS
  • cpe:2.3:a:impresscms:impresscms:*:rc1:*:*:*:*:*:* Versions up to 1.2.3 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.0:beta1:*:*:*:*:*:* Versions 1.0 beta1 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.0:beta2:*:*:*:*:*:* Versions 1.0 beta2 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.0:final:*:*:*:*:*:* Versions 1.0 final Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.0:rc1:*:*:*:*:*:* Versions 1.0 rc1 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.0:rc2:*:*:*:*:*:* Versions 1.0 rc2 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.0:rc3:*:*:*:*:*:* Versions 1.0 rc3 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1:alpha1:*:*:*:*:*:* Versions 1.1 alpha1 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1:alpha2:*:*:*:*:*:* Versions 1.1 alpha2 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1:beta1:*:*:*:*:*:* Versions 1.1 beta1 Vulnerable ·ImpressCMS
Show 23 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:impresscms:impresscms:1.1:final:*:*:*:*:*:*1.1 finalVulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1:rc1:*:*:*:*:*:*1.1 rc1VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1:rc2:*:*:*:*:*:*1.1 rc2VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1:rc3:*:*:*:*:*:*1.1 rc3VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1.1:final:*:*:*:*:*:*1.1.1 finalVulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1.1:rc1:*:*:*:*:*:*1.1.1 rc1VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1.1:rc2:*:*:*:*:*:*1.1.1 rc2VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1.2:final:*:*:*:*:*:*1.1.2 finalVulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1.2:rc1:*:*:*:*:*:*1.1.2 rc1VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1.2:rc2:*:*:*:*:*:*1.1.2 rc2VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1.3:beta:*:*:*:*:*:*1.1.3 betaVulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1.3:final:*:*:*:*:*:*1.1.3 finalVulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.1.3:rc1:*:*:*:*:*:*1.1.3 rc1VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.2:alpha1:*:*:*:*:*:*1.2 alpha1VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.2:alpha2:*:*:*:*:*:*1.2 alpha2VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.2:beta:*:*:*:*:*:*1.2 betaVulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.2:final:*:*:*:*:*:*1.2 finalVulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.2:rc1:*:*:*:*:*:*1.2 rc1VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.2:rc2:*:*:*:*:*:*1.2 rc2VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.2.1:beta:*:*:*:*:*:*1.2.1 betaVulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.2.1:final:*:*:*:*:*:*1.2.1 finalVulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.2.1:rc1:*:*:*:*:*:*1.2.1 rc1VulnerableImpressCMS
cpe:2.3:a:impresscms:impresscms:1.2.3:beta:*:*:*:*:*:*1.2.3 betaVulnerableImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1:final:*:*:*:*:*:* Versions 1.1 final Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1:rc1:*:*:*:*:*:* Versions 1.1 rc1 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1:rc2:*:*:*:*:*:* Versions 1.1 rc2 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1:rc3:*:*:*:*:*:* Versions 1.1 rc3 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1.1:final:*:*:*:*:*:* Versions 1.1.1 final Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1.1:rc1:*:*:*:*:*:* Versions 1.1.1 rc1 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1.1:rc2:*:*:*:*:*:* Versions 1.1.1 rc2 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1.2:final:*:*:*:*:*:* Versions 1.1.2 final Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1.2:rc1:*:*:*:*:*:* Versions 1.1.2 rc1 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1.2:rc2:*:*:*:*:*:* Versions 1.1.2 rc2 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1.3:beta:*:*:*:*:*:* Versions 1.1.3 beta Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1.3:final:*:*:*:*:*:* Versions 1.1.3 final Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.1.3:rc1:*:*:*:*:*:* Versions 1.1.3 rc1 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.2:alpha1:*:*:*:*:*:* Versions 1.2 alpha1 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.2:alpha2:*:*:*:*:*:* Versions 1.2 alpha2 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.2:beta:*:*:*:*:*:* Versions 1.2 beta Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.2:final:*:*:*:*:*:* Versions 1.2 final Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.2:rc1:*:*:*:*:*:* Versions 1.2 rc1 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.2:rc2:*:*:*:*:*:* Versions 1.2 rc2 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.2.1:beta:*:*:*:*:*:* Versions 1.2.1 beta Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.2.1:final:*:*:*:*:*:* Versions 1.2.1 final Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.2.1:rc1:*:*:*:*:*:* Versions 1.2.1 rc1 Vulnerable ·ImpressCMS
  • cpe:2.3:a:impresscms:impresscms:1.2.3:beta:*:*:*:*:*:* Versions 1.2.3 beta Vulnerable ·ImpressCMS

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-4271
  2. 2026-10-03 Alias added: GHSA-hh8r-mv36-fgxg

References

Other 2

  • TI-2022-26365 ImpressCMS 1.4.4 - Unrestricted File Upload CVSS 4.0CRITICAL 9.3
  • TI-2019-15755 ImpressCMS 1.3.11 SQL Injection via bid Parameter CVSS 4.0HIGH 7.1
  • TI-2021-08319 ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection. CVSS 3.1CRITICAL 9.8
  • TI-2023-19270 A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows… CVSS 3.1MEDIUM 4.8
  • TI-2022-08771 ImpressCMS before 1.4.2 allows unauthenticated remote code execution via .....///… CVSS 3.1CRITICAL 9.8
  • TI-2021-08320 ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant… CVSS 3.1CRITICAL 9.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences