Vulnerabilities

TI-2026-71892 CVE-2026-110025

Unrestricted upload in slackero phpwcms Extension Check

HIGH 70

A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00375 Published 2026-10-13 Fixed in 1.9.50, 1.12.4 CWE-284

TI-2021-22399 CVE-2021-47783 · GHSA-j425-3jgm-m83r

Phpwcms 1.9.30 - Arbitrary File Upload

MEDIUM 57

Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00321 Published 2026-01-15 No fix listed CWE-434

TI-2025-04939 CVE-2025-5499 · GHSA-rwr2-gc8x-639j

slackero phpwcms image_resized.php getimagesize deserialization

HIGH 70

A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00849 Published 2025-06-03 No fix listed CWE-20

TI-2025-04938 CVE-2025-5498 · GHSA-5fmq-4fvm-96qg

slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization

MEDIUM 56

A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00562 Published 2025-06-03 No fix listed CWE-20

TI-2025-04937 CVE-2025-5497 · GHSA-h582-52vg-77xv

slackero phpwcms Feedimport processing.inc.php deserialization

MEDIUM 57

A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00699 Published 2025-06-03 Fixed in 1.9.46, 1.10.9 CWE-20

TI-2021-14761 CVE-2021-36426 · GHSA-f43h-hw82-75jg

File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code…

HIGH 73

File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01058 Published 2023-02-03 No fix listed CWE-434

TI-2021-14760 CVE-2021-36425 · GHSA-7659-gxmp-p9hx

Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete…

MEDIUM 58

Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00975 Published 2023-02-03 No fix listed CWE-22

TI-2021-14759 CVE-2021-36424 · GHSA-rm9p-68g4-m5r5

An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via…

HIGH 82

An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01177 Published 2023-02-03 No fix listed CWE-94

TI-2021-03159 CVE-2021-4301 · GHSA-h482-q98v-xjj2

slackero phpwcms sql injection

MEDIUM 43

A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0075 Published 2023-01-07 No fix listed CWE-89

TI-2021-03160 CVE-2021-4302 · GHSA-6629-529f-2h95

slackero phpwcms SVG File cross site scripting

LOW 28

A vulnerability was found in slackero phpwcms up to 1.9.26.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00576 Published 2023-01-04 No fix listed CWE-79

TI-2020-13716 CVE-2020-19855 · GHSA-94c8-qvx9-76vq

phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php.

LOW 28

phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00662 Published 2021-09-07 No fix listed CWE-79

TI-2020-14162 CVE-2020-21784 · GHSA-9mfr-hm36-9xvq

phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.

MEDIUM 45

phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01398 Published 2021-06-24 No fix listed CWE-94

TI-2018-09321 CVE-2018-12990 · GHSA-3mcg-4jhc-4p5f

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.

LOW 26

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01159 Published 2018-06-30 No fix listed CWE-200

TI-2017-11619 CVE-2017-15872 · GHSA-f54v-vjvp-jcqm

phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmpl.php and…

LOW 23

phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmpl.php and include/inc_tmpl/admin.newuser.tmpl.php via the username (aka new_login) field.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00513 Published 2017-10-24 No fix listed CWE-79

TI-2011-03346 CVE-2011-3789 · GHSA-jp96-q59p-vwc9

phpwcms 1.4.7 r412 allows remote attackers to obtain sensitive information via a direct…

LOW 25

phpwcms 1.4.7 r412 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by template/inc_script/frontend_ren…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01229 Published 2011-09-24 No fix listed CWE-200

TI-2006-06761 CVE-2006-7019 · GHSA-pmv2-xx9v-m4r4

phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute…

LOW 38

phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via crafted arguments to the (1) text_evento and (2) email_eventonome_evento parameters to phpwcms_code_snippets/mail_f…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0248 Published 2007-02-15 No fix listed

TI-2006-06629 CVE-2006-6886 · GHSA-93r6-cfr5-pg63

phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct…

LOW 26

phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for (1) files.public-userroot.inc.php or (2) files.private.additions.inc.php in include/inc_lib/, which reveals the path in v…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01629 Published 2007-01-05 No fix listed CWE-200

TI-2006-02450 CVE-2006-2519 · GHSA-8mph-q733-2v79

Directory traversal vulnerability in include/inc_ext/spaw/spaw_control.class.php in…

LOW 17

Directory traversal vulnerability in include/inc_ext/spaw/spaw_control.class.php in phpwcms 1.2.5-DEV allows remote attackers to include arbitrary local files via ..

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.01649 Published 2006-05-22 No fix listed

TI-2006-02449 CVE-2006-2518 · GHSA-rgv8-xcp4-4v7v

Cross-site scripting (XSS) vulnerability in phpwcms 1.2.5-DEV allows remote attackers to…

LOW 16

Cross-site scripting (XSS) vulnerability in phpwcms 1.2.5-DEV allows remote attackers to inject arbitrary web script or HTML via the BL[be_cnt_plainhtml] parameter to include/inc_tmpl/content/cnt6.inc.php.

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.01387 Published 2006-05-22 No fix listed

TI-2005-03583 CVE-2005-3789 · GHSA-rc3g-f2jq-vw8x

Multiple directory traversal vulnerabilities in phpwcms 1.2.5 allow remote attackers to…

LOW 29

Multiple directory traversal vulnerabilities in phpwcms 1.2.5 allow remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03424 Published 2005-11-24 No fix listed

Vulnerabilities

Filters