Vulnerabilities

Filters

1 selected

26 records

Sort

Vendor: instantsoft Clear all filters

TI-2026-70556 CVE-2026-108568 · GHSA-p5x9-rh29-4r44

Data authenticity flaw in InstantSoft icms2 PayPal billing

MEDIUM 57

A vulnerability was determined in InstantSoft icms2 up to 2.18.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00133 Published 2026-10-11 No fix listed CWE-345

TI-2026-70555 CVE-2026-108567 · GHSA-2x23-44x6-qv92

Path traversal in InstantSoft icms2 Image Handler

MEDIUM 57

A vulnerability was found in InstantSoft icms2 up to 2.18.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00374 Published 2026-10-11 No fix listed CWE-22

TI-2026-70554 CVE-2026-108566 · GHSA-j944-2cmv-5vxf

Cross-site scripting in InstantSoft icms2 Private Message handler

MEDIUM 56

A vulnerability has been found in InstantSoft icms2 up to 2.18.2.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00241 Published 2026-10-11 No fix listed CWE-79

TI-2026-35988 CVE-2026-48707

InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning

MEDIUM 48

InstantCMS is a free and open source content management system.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00267 Published 2026-09-08 Fixed in 2.18.2 CWE-918

TI-2026-39443 CVE-2026-54611

InstantCMS has Remote Code Execution in package installer

MEDIUM 58

InstantCMS is a free and open source content management system.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00663 Published 2026-09-08 Fixed in 2.18.2 CWE-434

TI-2026-22590 CVE-2026-28281

InstantCMS has Multiple CSRF Vulnerabilities

LOW 30

InstantCMS is a free and open source content management system.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00152 Published 2026-03-09 Fixed in 2.18.1 CWE-352

TI-2025-36697 CVE-2025-59055

InstantCMS vulnerable to Server-Side Request Forgery via package installer

HIGH 65

InstantCMS is a free and open source content management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00454 Published 2025-09-11 No fix listed CWE-918

TI-2024-33783 CVE-2024-50348

InstantCMS has a Cross Site Scripting Vulnerability

MEDIUM 58

InstantCMS is a free and open source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00349 Published 2024-10-29 Fixed in 2.16.3 CWE-79

TI-2024-20590 CVE-2024-31213

InstantCMS Open Redirect vulnerability

MEDIUM 58

InstantCMS is a free and open source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00399 Published 2024-04-05 Fixed in 2.16.2 CWE-601

TI-2024-20589 CVE-2024-31212

SQL injection in index_chart_data action

HIGH 67

InstantCMS is a free and open source content management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00854 Published 2024-04-04 No fix listed CWE-20

TI-2023-04538 CVE-2023-4928 · GHSA-36hm-c3f9-q57c

SQL Injection in instantsoft/icms2

HIGH 67

SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00902 Published 2023-09-13 Fixed in 2.16.1 CWE-89

TI-2023-04493 CVE-2023-4879 · GHSA-658q-9r9r-h96x

Cross-site Scripting (XSS) - Stored in instantsoft/icms2

LOW 22

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00402 Published 2023-09-10 Fixed in 2.16.1.-git CWE-79

TI-2023-04492 CVE-2023-4878 · GHSA-w3hc-fc6c-v6hj

Server-Side Request Forgery (SSRF) in instantsoft/icms2

LOW 25

Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00376 Published 2023-09-10 Fixed in 2.16.1-git CWE-918

TI-2023-04335 CVE-2023-4704 · GHSA-wwr6-8p5g-fwf7

External Control of System or Configuration Setting in instantsoft/icms2

MEDIUM 58

External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00891 Published 2023-09-01 Fixed in 2.16.1-git CWE-15

TI-2023-04290 CVE-2023-4654 · GHSA-9q2q-rv8x-x676

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2

MEDIUM 50

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00339 Published 2023-08-31 Fixed in 2.16.1 CWE-614

TI-2023-04291 CVE-2023-4655 · GHSA-5x3r-fvpc-645c

Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

MEDIUM 60

Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00467 Published 2023-08-31 Fixed in 2.16.1 CWE-79

TI-2023-04286 CVE-2023-4650 · GHSA-vp69-r7gq-xp5p

Improper Access Control in instantsoft/icms2

MEDIUM 55

Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00538 Published 2023-08-31 Fixed in 2.16.1-git CWE-284

TI-2023-04285 CVE-2023-4649 · GHSA-v6v4-5w5j-fcq8

Session Fixation in instantsoft/icms2

MEDIUM 58

Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00438 Published 2023-08-31 Fixed in 2.16.1 CWE-384

TI-2023-04287 CVE-2023-4651 · GHSA-wrv9-8qw6-67rv

Server-Side Request Forgery (SSRF) in instantsoft/icms2

MEDIUM 58

Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00415 Published 2023-08-31 Fixed in 2.16.1 CWE-918

TI-2023-04289 CVE-2023-4653 · GHSA-wwmp-qg3g-rq8m

Cross-site Scripting (XSS) - Stored in instantsoft/icms2

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00492 Published 2023-08-31 Fixed in 2.16.1-git CWE-79

TI-2023-04288 CVE-2023-4652 · GHSA-pwh6-38cc-87qf

Cross-site Scripting (XSS) - Stored in instantsoft/icms2

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00506 Published 2023-08-31 Fixed in 2.16.1-git CWE-79

TI-2023-04047 CVE-2023-4381 · GHSA-3vxj-947v-9gfh

Unverified Password Change in instantsoft/icms2

LOW 20

Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00432 Published 2023-08-16 Fixed in 2.16.1-git CWE-620

TI-2023-03878 CVE-2023-4189 · GHSA-cx85-vw9h-mf4j

Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

MEDIUM 55

Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00473 Published 2023-08-05 Fixed in 2.16.1-git CWE-79

TI-2023-03877 CVE-2023-4188 · GHSA-h267-xjjf-qgxq

SQL Injection in instantsoft/icms2

HIGH 80

SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00928 Published 2023-08-05 Fixed in 2.16.1-git CWE-89

TI-2023-03876 CVE-2023-4187 · GHSA-crx8-5gw7-25m9

Cross-site Scripting (XSS) - Stored in instantsoft/icms2

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00473 Published 2023-08-05 Fixed in 2.16.1-git CWE-79