Vulnerabilities

TI-2020-19372 CVE-2020-37237 · GHSA-85qg-778w-mp8h

Composr CMS 10.0.34 Persistent Cross-Site Scripting via banners

MEDIUM 56

Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the banner management interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00239 Published 2026-05-16 No fix listed CWE-79

TI-2021-16278 CVE-2021-38708 · GHSA-v6fx-fhrc-hc8m

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.

LOW 25

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00466 Published 2021-08-16 No fix listed CWE-79

TI-2021-16279 CVE-2021-38709 · GHSA-4v6c-4429-5c64

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the…

LOW 28

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff_messaging messaging system for XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00581 Published 2021-08-16 No fix listed CWE-79

TI-2018-04798 CVE-2018-6518 · GHSA-xxcj-mmq5-mg5m

Composr CMS 10.0.13 has XSS via the site_name parameter in a…

LOW 23

Composr CMS 10.0.13 has XSS via the site_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00769 Published 2018-04-26 No fix listed CWE-79

Vulnerabilities

Filters

Composr CMS 10.0.34 Persistent Cross-Site Scripting via banners

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the…

Composr CMS 10.0.13 has XSS via the site_name parameter in a…