Vulnerabilities

TI-2025-13826 CVE-2025-15148 · GHSA-m496-m5ff-4j4p

CmsEasy Backend Template Management template_admin.php savetemp_action code injection

MEDIUM 56

A flaw has been found in CmsEasy up to 7.7.7.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00481 Published 2025-12-28 No fix listed CWE-74

TI-2025-10380 CVE-2025-11332 · GHSA-58ff-3f7r-gpxr

CmsEasy URL view.php cross site scripting

MEDIUM 56

A vulnerability was determined in CmsEasy up to 7.7.7.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00303 Published 2025-10-06 No fix listed CWE-79

TI-2025-35202 CVE-2025-55910 · GHSA-5r67-w9x9-qvv7

CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.

MEDIUM 61

CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00222 Published 2025-09-19 No fix listed CWE-459

TI-2025-01147 CVE-2025-1336 · GHSA-p3mp-3q3j-c55p

CmsEasy image_admin.php deleteimg_action path traversal

MEDIUM 57

A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01033 Published 2025-02-16 No fix listed CWE-22

TI-2025-01146 CVE-2025-1335 · GHSA-5r34-52qx-f673

CmsEasy file_admin.php deleteimg_action path traversal

MEDIUM 57

A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0094 Published 2025-02-16 No fix listed CWE-22

TI-2025-00940 CVE-2025-1106 · GHSA-c25w-qrwc-j6xp

CmsEasy database_admin.php restore_action path traversal

MEDIUM 57

A vulnerability classified as critical has been found in CmsEasy 7.7.7.9.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00981 Published 2025-02-07 No fix listed CWE-22

TI-2025-00824 CVE-2025-0973 · GHSA-f4w4-7455-jm45

CmsEasy index.php backAll_action path traversal

MEDIUM 57

A vulnerability classified as critical was found in CmsEasy 7.7.7.9.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00855 Published 2025-02-03 No fix listed CWE-22

TI-2024-22671 CVE-2024-34315 · GHSA-mg24-mpj4-j47p

CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the…

MEDIUM 40

CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/template_admin.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0067 Published 2024-05-07 No fix listed CWE-22

TI-2024-22670 CVE-2024-34314 · GHSA-pqhh-45r9-vjw6

CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the…

HIGH 66

CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template_admin.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00446 Published 2024-05-07 No fix listed CWE-98

TI-2024-20873 CVE-2024-31551 · GHSA-6pwf-hhh9-vp2c

Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9…

HIGH 72

Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00687 Published 2024-04-26 No fix listed CWE-26

TI-2024-21241 CVE-2024-32236 · GHSA-f79m-6547-466x

An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive…

MEDIUM 50

An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component.

CVSS 3.1LOW 3.5 Adjacent network Low privileges No interaction EPSS 0.00411 Published 2024-04-25 No fix listed CWE-922

TI-2024-21229 CVE-2024-32163 · GHSA-9rxh-hjp4-932m

CMSeasy 7.7.7.9 is vulnerable to code execution.

MEDIUM 64

CMSeasy 7.7.7.9 is vulnerable to code execution.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.00322 Published 2024-04-17 No fix listed CWE-22

TI-2024-21228 CVE-2024-32162 · GHSA-p88h-cqcf-h49q

CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.

MEDIUM 53

CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.004 Published 2024-04-17 No fix listed CWE-791

TI-2024-16959 CVE-2024-25828 · GHSA-wgvc-4hpw-3247

cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.

MEDIUM 56

cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00614 Published 2024-02-22 No fix listed CWE-27

TI-2024-00482 CVE-2024-0523 · GHSA-fxcx-28x2-8q66

CmsEasy language_admin.php getslide_child_action sql injection

HIGH 75

A vulnerability was found in CmsEasy up to 7.7.7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00709 Published 2024-01-14 No fix listed CWE-89

TI-2020-13378 CVE-2020-18406 · GHSA-wxm7-fv5m-rc6h

An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in…

HIGH 72

An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00365 Published 2023-06-27 No fix listed CWE-522

TI-2023-17429 CVE-2023-34880 · GHSA-v4xm-h78v-wx67

cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via…

HIGH 82

cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01072 Published 2023-06-15 No fix listed CWE-22

TI-2021-18880 CVE-2021-42644 · GHSA-w63g-vjrv-wqjc

cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability.

LOW 31

cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00982 Published 2022-05-17 No fix listed CWE-552

TI-2021-18879 CVE-2021-42643 · GHSA-x6r6-w4vr-79gv

cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability.

MEDIUM 42

cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01752 Published 2022-05-17 No fix listed CWE-22

TI-2019-06051 CVE-2019-8434 · GHSA-x3v5-gr92-w6fg

In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter.

LOW 29

In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00752 Published 2019-02-18 No fix listed CWE-79

TI-2019-06049 CVE-2019-8432 · GHSA-w6q5-pm9c-xjjv

In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter.

LOW 29

In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00752 Published 2019-02-18 No fix listed CWE-79

TI-2018-08347 CVE-2018-11680 · GHSA-6295-q4f9-4m32

An issue was discovered in CmsEasy 6.1_20180508.

LOW 29

An issue was discovered in CmsEasy 6.1_20180508.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.0041 Published 2018-06-02 No fix listed CWE-352

TI-2018-08346 CVE-2018-11679 · GHSA-298j-cm7q-56g9

An issue was discovered in CmsEasy 6.1_20180508.

LOW 39

An issue was discovered in CmsEasy 6.1_20180508.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0053 Published 2018-06-02 No fix listed CWE-352

Vulnerabilities

Filters