Vulnerabilities

TI-2024-38394 CVE-2024-58297 · GHSA-5gm4-757j-3p92

PyroCMS v3.0.1 Stored Cross-Site Scripting via Admin Redirects

MEDIUM 57

PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00256 Published 2025-12-11 No fix listed CWE-79

TI-2023-13964 CVE-2023-29689 · GHSA-w7vm-4v3j-vgpw

PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited…

HIGH 82

PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.53463 Published 2023-08-04 No fix listed

TI-2022-17541 CVE-2022-37721 · GHSA-cm7f-hf2g-ghrp

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged…

MEDIUM 42

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privi…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00769 Published 2022-11-25 No fix listed CWE-79

TI-2022-15847 CVE-2022-35118 · GHSA-9725-wqpv-8rxj

PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

LOW 28

PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00526 Published 2022-08-01 No fix listed CWE-79

TI-2020-15497 CVE-2020-25262 · GHSA-56xx-pv88-2662

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

LOW 21

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00526 Published 2020-10-08 No fix listed CWE-352

TI-2020-15498 CVE-2020-25263 · GHSA-vg2g-698h-v9w3

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the…

LOW 32

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary plugin will be deleted.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00599 Published 2020-10-08 No fix listed CWE-352

Vulnerabilities

Filters

PyroCMS v3.0.1 Stored Cross-Site Scripting via Admin Redirects

PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited…

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged…

PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the…