Vulnerabilities

TI-2026-23402 CVE-2026-29934 · GHSA-phpm-chh7-7xg9

A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of…

MEDIUM 60

A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referer value in…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00206 Published 2026-03-26 No fix listed CWE-79

TI-2024-15065 CVE-2024-22559 · GHSA-5pp3-xch3-9qv7

LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.

MEDIUM 58

LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00325 Published 2024-01-29 No fix listed CWE-79

TI-2023-11891 CVE-2023-27060 · GHSA-j658-jwc9-69qv

LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function.

HIGH 82

LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01302 Published 2023-03-22 No fix listed CWE-306

TI-2022-14516 CVE-2022-33009 · GHSA-f47m-pm58-rvx2

A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to…

LOW 23

A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0052 Published 2022-06-27 No fix listed CWE-79

TI-2021-08673 CVE-2021-27112 · GHSA-4v47-26g5-4434

LightCMS v1.3.5 contains a remote code execution vulnerability in…

MEDIUM 47

LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading of external images.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02423 Published 2021-04-15 No fix listed

TI-2021-02351 CVE-2021-3355 · GHSA-h87g-cj47-crv7

A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or…

LOW 35

A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0725 Published 2021-02-24 No fix listed CWE-79

Vulnerabilities

Filters

A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of…

LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.

LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function.

A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to…

LightCMS v1.3.5 contains a remote code execution vulnerability in…

A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or…