TI-2025-37018 CVE-2025-59473 · GHSA-jwfj-m7v6-748m
SQL Injection vulnerability in the Structure for Admin authenticated user
Priority LOW 31
SQL Injection vulnerability in the Structure for Admin authenticated user
Vulnerabilities
14 records
TI-2024-25698 CVE-2024-38454 · GHSA-9wh8-7hw4-wc5g
ExpressionEngine before 7.4.11 allows XSS.
Priority LOW 27
ExpressionEngine before 7.4.11 allows XSS.
TI-2023-09084 CVE-2023-22953 · GHSA-5m73-j6gp-6p7m
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
Priority MEDIUM 41
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
TI-2020-06660 CVE-2020-8242 · GHSA-jxgv-5936-493f
SQL injection in ExpressionEngine
Priority LOW 33
Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection.
TI-2021-12747 CVE-2021-33199 · GHSA-95cm-jhq2-c7fg
In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the…
Priority MEDIUM 45
In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file names of icon.png and icon.svg.
TI-2021-08771 CVE-2021-27230 · GHSA-6p92-pcf6-32pp
ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain…
Priority MEDIUM 43
ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory.
TI-2020-10544 CVE-2020-13443 · GHSA-m6qg-wrwf-hqr2
ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary…
Priority MEDIUM 45
ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions.
TI-2018-12708 CVE-2018-17874 · GHSA-hjjp-hc99-6gw9
ExpressionEngine before 4.3.5 has reflected XSS.
Priority LOW 28
ExpressionEngine before 4.3.5 has reflected XSS.
TI-2017-14494 CVE-2017-1000160 · GHSA-v385-82h8-gh8f
EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection
Priority LOW 25
EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection
TI-2017-00845 CVE-2017-0897 · GHSA-cqj4-ph2f-7q79
ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing…
Priority MEDIUM 40
ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy.
TI-2014-04390 CVE-2014-5387 · GHSA-2rf3-3mwr-3pqg
Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow…
Priority LOW 32
Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.ph…
TI-2009-01024 CVE-2009-1070 · GHSA-mcq6-hwmc-gp67
Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4…
Priority LOW 23
Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the avatar parameter…
TI-2008-00184 CVE-2008-0202 · GHSA-w86x-6fw3-w2rf
CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows…
Priority LOW 23
CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter.
TI-2008-00183 CVE-2008-0201 · GHSA-p97w-jh7j-g247
Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and…
Priority LOW 23
Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameter.