Vulnerabilities

Filters

Reset all

2 selected

36 records

Sort

Vendor: Intelliants Component: Subrion Cms Clear all filters

TI-2025-43172 CVE-2025-70958 · GHSA-9jjm-mc56-3qxv

Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module…

MEDIUM 60

Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00289 Published 2026-02-02 No fix listed CWE-79

TI-2025-35369 CVE-2025-56556 · GHSA-h8wv-vv58-468h

An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or…

MEDIUM 53

An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel - to gain escalated privileges in the cont…

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.002 Published 2025-09-11 No fix listed CWE-566

TI-2024-16724 CVE-2024-25399 · GHSA-q4qh-8pxw-r48q

Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.

LOW 27

Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00347 Published 2024-02-27 No fix listed CWE-79

TI-2023-23544 CVE-2023-43875 · GHSA-646r-8fcc-p82r

Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS…

MEDIUM 60

Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminuse…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0083 Published 2023-10-19 No fix listed CWE-79

TI-2022-21043 CVE-2022-43121 · GHSA-jrvr-gmqv-hgrh

A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants…

MEDIUM 60

A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tooltip text field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0072 Published 2022-11-09 No fix listed CWE-79

TI-2022-21042 CVE-2022-43120 · GHSA-3wmg-28v9-8hf6

A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of…

LOW 28

A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field defa…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00619 Published 2022-11-09 No fix listed CWE-79

TI-2022-17252 CVE-2022-37059 · GHSA-rh4r-9689-6xw4

Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field

LOW 23

Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00576 Published 2022-08-29 No fix listed CWE-79

TI-2021-18259 CVE-2021-41502 · GHSA-jvq4-cgfw-jgf4

An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting…

LOW 25

An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or ad…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00562 Published 2022-06-11 No fix listed CWE-79

TI-2021-19389 CVE-2021-43464 · GHSA-g54x-29xv-58h5

A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code…

MEDIUM 41

A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval().

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01415 Published 2022-04-04 No fix listed

TI-2020-13366 CVE-2020-18325 · GHSA-pcwq-7wrw-r8jv

Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.

LOW 31

Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01644 Published 2022-03-04 No fix listed CWE-79

TI-2020-13365 CVE-2020-18324 · GHSA-xj7h-g7rh-gjcw

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.

LOW 31

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02166 Published 2022-03-04 No fix listed CWE-79

TI-2020-13367 CVE-2020-18326 · GHSA-9cc3-5w85-pxvx

Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1…

MEDIUM 42

Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victi…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02243 Published 2022-03-04 No fix listed CWE-352

TI-2021-19544 CVE-2021-43724 · GHSA-5r5f-mpwf-fmh5

A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the…

LOW 23

A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00494 Published 2022-02-23 No fix listed CWE-79

TI-2021-18503 CVE-2021-41947 · GHSA-4gwf-j8pg-pfjm

A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode.

LOW 34

A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01187 Published 2021-10-08 No fix listed CWE-89

TI-2020-14332 CVE-2020-22392 · GHSA-hxj6-v58r-cqv3

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.

LOW 25

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00621 Published 2021-08-05 No fix listed CWE-79

TI-2020-17974 CVE-2020-35437 · GHSA-3qr9-c3gf-9v7v

Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path]…

LOW 33

Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the /_core/profile/ URI.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03067 Published 2020-12-26 No fix listed CWE-79

TI-2019-05240 CVE-2019-7357 · GHSA-5mh2-82g9-72jv

Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/.

MEDIUM 41

Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0136 Published 2020-11-10 No fix listed CWE-352

TI-2019-08522 CVE-2019-11406 · GHSA-7ph5-f3jm-j978

Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter.

LOW 29

Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00947 Published 2019-05-08 No fix listed CWE-79

TI-2017-13539 CVE-2017-18366 · GHSA-c939-g732-48r8

Subrion CMS 4.1.5 has CSRF in blog/delete/.

LOW 39

Subrion CMS 4.1.5 has CSRF in blog/delete/.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0065 Published 2019-04-12 Fixed in 4.2.1 CWE-352

TI-2018-11918 CVE-2018-16631 · GHSA-m4pp-4rvc-85j4

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.

LOW 25

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00556 Published 2018-12-04 No fix listed CWE-79

TI-2018-11916 CVE-2018-16629 · GHSA-mxv3-qcmf-r6wj

panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.

LOW 23

panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00565 Published 2018-12-04 No fix listed CWE-79

TI-2018-13753 CVE-2018-19422 · GHSA-73xj-v6gc-g5p5

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code…

HIGH 67

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.64507 Published 2018-11-21 Fixed in 4.2.2 CWE-434

TI-2017-08465 CVE-2017-11445 · GHSA-8g98-32v4-74xj

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.

MEDIUM 44

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01137 Published 2017-07-19 No fix listed CWE-89

TI-2017-08464 CVE-2017-11444 · GHSA-54w5-rqwx-v5gj

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.

MEDIUM 57

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.13098 Published 2017-07-19 No fix listed CWE-89

TI-2017-03976 CVE-2017-6069 · GHSA-8vm8-w94h-5m67

Subrion CMS 4.0.5 has CSRF in admin/blog/add/.

LOW 39

Subrion CMS 4.0.5 has CSRF in admin/blog/add/.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00723 Published 2017-03-27 No fix listed CWE-352