Vulnerabilities

TI-2024-16725 CVE-2024-25400

Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php.

HIGH 82

Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00659 Published 2024-02-27 No fix listed CWE-89

TI-2023-25347 CVE-2023-46947 · GHSA-2x28-c7j7-23gv

Subrion 4.2.1 has a remote command execution vulnerability in the backend.

HIGH 73

Subrion 4.2.1 has a remote command execution vulnerability in the backend.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01548 Published 2023-11-03 No fix listed CWE-94

TI-2023-23549 CVE-2023-43884 · GHSA-7vff-rv2f-cj79

A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions…

MEDIUM 58

A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' param…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00464 Published 2023-09-28 No fix listed CWE-79

TI-2023-23514 CVE-2023-43830 · GHSA-q832-2275-rfqh

A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion…

MEDIUM 58

A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum depos…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2023-09-27 No fix listed CWE-79

TI-2023-23513 CVE-2023-43828 · GHSA-4w2j-wj9q-6wpx

A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow…

MEDIUM 58

A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2023-09-27 No fix listed CWE-79

TI-2021-18504 CVE-2021-41948 · GHSA-jv64-2m3x-6v4q

A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion…

LOW 25

A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00487 Published 2022-04-29 No fix listed CWE-79

TI-2020-14326 CVE-2020-22330 · GHSA-jj94-j4r3-5gr4

Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.

LOW 28

Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00641 Published 2021-08-06 Fixed in 4.2.2 CWE-79

TI-2020-13326 CVE-2020-18155 · GHSA-7q44-gfvq-6g93

SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.

MEDIUM 45

SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01338 Published 2021-07-14 No fix listed CWE-89

TI-2020-14664 CVE-2020-23761 · GHSA-xhc3-5pgf-p576

Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote…

LOW 29

Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01009 Published 2021-04-09 No fix listed CWE-79

TI-2019-05239 CVE-2019-7356 · GHSA-pmm5-68m2-34h8

Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.

LOW 26

Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00754 Published 2020-11-04 No fix listed CWE-79

TI-2019-14624 CVE-2019-20390 · GHSA-c4wx-3x5q-hf4w

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1…

LOW 36

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit a…

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00675 Published 2020-05-15 No fix listed CWE-352

TI-2019-14623 CVE-2019-20389 · GHSA-xvgx-668j-f67p

An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general…

LOW 29

An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00949 Published 2020-05-15 No fix listed CWE-79

TI-2020-09968 CVE-2020-12467 · GHSA-qpxw-6473-ppww

Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.

LOW 31

Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00939 Published 2020-04-29 No fix listed CWE-384

TI-2020-09969 CVE-2020-12468 · GHSA-4f4h-jgjp-3vfg

Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language.

LOW 36

Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00858 Published 2020-04-29 No fix listed

TI-2020-09970 CVE-2020-12469 · GHSA-fmqq-hw9m-448q

admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant…

LOW 30

admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00864 Published 2020-04-29 No fix listed CWE-502

TI-2018-14999 CVE-2018-21037 · GHSA-g8j7-w673-4mjp

Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator…

LOW 39

Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00513 Published 2020-03-17 Fixed in 4.2.1 CWE-352

TI-2019-12843 CVE-2019-17225 · GHSA-mw5h-w3p2-8ph2

Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka…

LOW 28

Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01938 Published 2019-10-06 No fix listed CWE-79

TI-2018-08064 CVE-2018-11317 · GHSA-2cmg-vxvh-8h7h

Subrion CMS before 4.1.4 has XSS.

LOW 29

Subrion CMS before 4.1.4 has XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00905 Published 2019-07-03 Fixed in 4.1.4 CWE-79

TI-2018-11098 CVE-2018-15563 · GHSA-6wc4-v4v5-3m82

_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.

LOW 28

_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00686 Published 2018-10-02 No fix listed CWE-79

TI-2018-11693 CVE-2018-16327 · GHSA-9738-c49q-4rgc

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.

LOW 23

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2018-09-01 No fix listed CWE-79

TI-2018-10667 CVE-2018-14840 · GHSA-vhqr-3gr2-7px9

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file…

LOW 34

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.03666 Published 2018-08-02 Fixed in 4.2.2 CWE-79

TI-2017-11055 CVE-2017-15063 · GHSA-rc94-7v55-wmg6

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0…

LOW 39

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00515 Published 2017-10-06 Fixed in 4.2.0 CWE-352

TI-2017-07900 CVE-2017-10795 · GHSA-2xv7-fwh6-x7fc

Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to…

LOW 30

Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01133 Published 2017-07-02 Fixed in 4.1.6 CWE-79

TI-2017-03557 CVE-2017-5543 · GHSA-4j79-4m6q-77vf

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to…

MEDIUM 46

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02031 Published 2017-01-20 Fixed in 4.1.0 CWE-94

TI-2014-07406 CVE-2014-9120 · GHSA-xjr9-2wf2-3v4w

Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote…

LOW 22

Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to subrion/search/.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0099 Published 2014-12-10 Fixed in 3.2.3 CWE-79

Vulnerabilities

Filters