Vulnerabilities

TI-2025-19201 CVE-2025-25960 · GHSA-cwp8-xjvj-w9x6

Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to…

MEDIUM 60

Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00282 Published 2025-02-20 No fix listed CWE-79

TI-2025-19200 CVE-2025-25958 · GHSA-m4vh-3qj9-43jx

Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to…

MEDIUM 58

Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00264 Published 2025-02-20 No fix listed CWE-79

TI-2021-17823 CVE-2021-40910 · GHSA-g6p4-fv6m-vf86

There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.

LOW 28

There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00667 Published 2022-06-15 No fix listed CWE-79

TI-2020-14296 CVE-2020-22203 · GHSA-hrm8-gqcw-5xw2

SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php.

MEDIUM 44

SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01116 Published 2021-06-16 No fix listed CWE-89

TI-2020-14295 CVE-2020-22201 · GHSA-88x2-cfv5-j89g

phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the…

MEDIUM 41

phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01472 Published 2021-06-16 No fix listed CWE-94

TI-2020-14294 CVE-2020-22200 · GHSA-4j63-75hf-7942

Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword.

LOW 27

Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01444 Published 2021-06-16 No fix listed CWE-22

TI-2020-14293 CVE-2020-22199 · GHSA-p6gj-r775-94g2

SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php.

MEDIUM 44

SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01179 Published 2021-06-16 No fix listed CWE-89

TI-2019-07363 CVE-2019-10027 · GHSA-whgg-hmm4-4243

PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.

LOW 23

PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00726 Published 2019-03-24 No fix listed CWE-79

TI-2018-13561 CVE-2018-19127 · GHSA-p498-q357-m3p7

A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write…

MEDIUM 61

A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.20766 Published 2018-11-09 No fix listed CWE-94

TI-2018-10747 CVE-2018-14940 · GHSA-j479-rcfp-64jg

PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via…

LOW 35

PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkcode request.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01303 Published 2018-08-05 No fix listed CWE-400

TI-2013-05064 CVE-2013-5939 · GHSA-x9gq-5263-4j37

Multiple cross-site scripting (XSS) vulnerabilities in the Guestbook module for PHPCMS…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in the Guestbook module for PHPCMS allow remote attackers to inject arbitrary web script or HTML via the (1) list or (2) introduce parameter to index.php.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01854 Published 2014-05-14 No fix listed CWE-79

TI-2011-00562 CVE-2011-0645 · GHSA-3qxq-5jcx-g5cg

SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to…

LOW 35

SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the where_time parameter in a get action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00999 Published 2011-01-25 No fix listed CWE-89

TI-2011-00561 CVE-2011-0644 · GHSA-5m78-jr6f-rgf5

SQL injection vulnerability in include/admin/model_field.class.php in PHPCMS 2008 V2…

LOW 35

SQL injection vulnerability in include/admin/model_field.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the modelid parameter to flash_upload.php.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01165 Published 2011-01-25 No fix listed CWE-89

TI-2008-00485 CVE-2008-0513 · GHSA-54hm-whm8-53qp

Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS…

MEDIUM 40

Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a ..

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.03501 Published 2008-01-31 No fix listed CWE-22

TI-2006-02923 CVE-2006-3019 · GHSA-w739-r6v2-x43x

Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote…

MEDIUM 43

Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in parser/include/ including (1) class.par…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.07884 Published 2006-06-15 No fix listed CWE-94

TI-2005-01747 CVE-2005-1840 · GHSA-frh2-jr4f-m53f

Directory traversal vulnerability in class.layout_phpcms.php in phpCMS 1.2.x before…

LOW 27

Directory traversal vulnerability in class.layout_phpcms.php in phpCMS 1.2.x before 1.2.1pl2 allows remote attackers to read or include arbitrary files, as demonstrated using a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01841 Published 2005-06-02 No fix listed

TI-2004-01096 CVE-2004-1203 · GHSA-gr6f-v7pv-5m9g

parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows…

LOW 26

parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to gain sensitive information via an invalid file parameter, which reveals the web server's installation path.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01388 Published 2004-12-15 No fix listed

TI-2004-01095 CVE-2004-1202 · GHSA-m4wf-cgh7-9gv4

Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with…

LOW 34

Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02299 Published 2004-12-15 No fix listed

Vulnerabilities

Filters