Vulnerabilities

TI-2026-03275 CVE-2026-3786 · GHSA-23h5-crhx-4jpw

EasyCMS Request Parameter RbacuserAction.class.php sql injection

MEDIUM 57

A security flaw has been discovered in EasyCMS up to 1.6.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00313 Published 2026-03-08 No fix listed CWE-74

TI-2026-03274 CVE-2026-3785 · GHSA-8w64-x7wq-f592

EasyCMS Request Parameter RbacnodeAction.class.php sql injection

MEDIUM 57

A vulnerability was identified in EasyCMS up to 1.6.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00313 Published 2026-03-08 No fix listed CWE-74

TI-2026-00834 CVE-2026-1105 · GHSA-6rcf-63m4-v8rw

EasyCMS UserAction.class.php sql injection

HIGH 70

A vulnerability was identified in EasyCMS up to 1.6.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00478 Published 2026-01-17 No fix listed CWE-74

TI-2022-07460 CVE-2022-23358 · GHSA-wwq9-3w37-xj9v

EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php.

MEDIUM 44

EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01213 Published 2022-02-16 No fix listed CWE-89

TI-2020-14862 CVE-2020-24271 · GHSA-wfj8-v9x3-cw4h

A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through…

LOW 39

A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post username=***&password=***.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0061 Published 2021-02-01 No fix listed CWE-352

TI-2019-04481 CVE-2019-6294 · GHSA-6m27-4g36-q4r5

An issue was discovered in EasyCMS 1.5.

LOW 39

An issue was discovered in EasyCMS 1.5.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00523 Published 2019-01-15 No fix listed CWE-352

TI-2018-12232 CVE-2018-17113 · GHSA-v28m-2f54-wwf7

App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5…

LOW 28

App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter, a related issue to CVE-2018-9173.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00643 Published 2018-09-17 No fix listed CWE-79

TI-2018-12010 CVE-2018-16773 · GHSA-5cq6-j3hg-gxhm

EasyCMS 1.5 allows XSS via the…

LOW 23

EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00548 Published 2018-09-10 No fix listed CWE-79

TI-2018-11997 CVE-2018-16759 · GHSA-qgvv-r2mj-f75g

The removeXSS function in App/Common/common.php (called from…

LOW 28

The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00707 Published 2018-09-09 No fix listed CWE-79

TI-2018-11709 CVE-2018-16345 · GHSA-wmqj-3p3m-7m45

An issue was discovered in EasyCMS 1.5.

LOW 39

An issue was discovered in EasyCMS 1.5.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00523 Published 2018-09-02 No fix listed CWE-352

TI-2018-09307 CVE-2018-12971 · GHSA-666x-xpwv-64xg

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.

LOW 29

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.0044 Published 2018-06-29 No fix listed CWE-352

TI-2018-07345 CVE-2018-10374 · GHSA-4xc6-4jhv-986h

EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an…

LOW 28

EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html request.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00669 Published 2018-04-25 No fix listed CWE-79

Vulnerabilities

Filters