TI-2025-14067 CVE-2025-15423 · GHSA-p2h8-g3qw-gm52
EmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted upload
Priority MEDIUM 57
A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0.
Vulnerabilities
17 records
TI-2025-14066 CVE-2025-15422 · GHSA-2223-q26h-rqmg
EmpireSoft EmpireCMS IP Address connect.php egetip protection mechanism
Priority HIGH 70
A flaw has been found in EmpireSoft EmpireCMS up to 8.0.
TI-2023-27405 CVE-2023-50162 · GHSA-vqqj-jrgg-4rq8
SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute…
Priority HIGH 67
SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the DoExecSql function.
TI-2022-11245 CVE-2022-28585 · GHSA-4r54-p7h8-fw6x
EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php
Priority MEDIUM 44
EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php
TI-2020-14423 CVE-2020-22937 · GHSA-f8j7-34r5-rv6c
A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to…
Priority MEDIUM 47
A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install file.
TI-2018-13781 CVE-2018-19461 · GHSA-f2vw-37xv-2cxr
admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.
Priority LOW 24
admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.
TI-2018-13782 CVE-2018-19462 · GHSA-m6qm-rc68-729q
admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary…
Priority LOW 36
admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php.
TI-2019-09212 CVE-2019-12362 · GHSA-cwx3-h7cf-3jpw
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.
Priority LOW 29
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.
TI-2019-09211 CVE-2019-12361 · GHSA-3g6f-gvxf-2qx6
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated…
Priority LOW 27
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template.
TI-2018-13048 CVE-2018-18449 · GHSA-82gr-g8r8-2vh3
EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to…
Priority LOW 39
EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339.
TI-2018-14362 CVE-2018-20300 · GHSA-cwhf-vqf3-q732
Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp…
Priority MEDIUM 45
Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file.
TI-2018-13369 CVE-2018-18869 · GHSA-4vx5-4pfx-2jm6
EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F…
Priority MEDIUM 48
EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter.
TI-2018-12851 CVE-2018-18086 · GHSA-j396-rrg7-mw2x
EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in…
Priority MEDIUM 41
EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users.
TI-2018-11705 CVE-2018-16339 · GHSA-8fqv-93g6-24c7
An issue was discovered in EmpireCMS 7.0.
Priority LOW 39
An issue was discovered in EmpireCMS 7.0.
TI-2018-05027 CVE-2018-6881 · GHSA-fc36-cvc7-f5jj
EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a…
Priority LOW 28
EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.
TI-2018-05026 CVE-2018-6880 · GHSA-qpwj-fcq8-gvwh
EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array…
Priority LOW 28
EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php.
TI-2012-04820 CVE-2012-5777 · GHSA-3jpp-jwvr-524v
Eval injection vulnerability in the ReplaceListVars function in the template parser in…
Priority LOW 34
Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackers to execute arbitrary PHP code via a crafted template.