Vulnerabilities

TI-2025-00939 CVE-2025-1105 · GHSA-c7v2-cqjq-g6rr

SiberianCMS HTTP GET Request flat cross site scripting

LOW 24

A vulnerability was found in SiberianCMS 4.20.6.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00394 Published 2025-02-07 No fix listed CWE-79

TI-2024-27762 CVE-2024-41702 · GHSA-fm3g-m5v8-xw6m

SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

MEDIUM 49

SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00465 Published 2024-07-30 Fixed in Upgrade to version 5.0.11 CWE-89

TI-2023-20517 CVE-2023-39378 · GHSA-7cq7-xjf7-493q

SQL injection in SiberianCMS

MEDIUM 42

SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') by an unauthenticated user

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00913 Published 2023-09-26 No fix listed CWE-89

TI-2023-20516 CVE-2023-39377 · GHSA-m7m7-9gfg-6cxv

Unrestricted file upload in SiberianCMS

LOW 36

SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01025 Published 2023-09-26 No fix listed CWE-434

TI-2023-20515 CVE-2023-39376 · GHSA-23wv-pq77-4gp7

SiberianCMS - CWE-284: Improper Access Control Authorized user may disable a security feature over the network

LOW 31

SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00445 Published 2023-09-26 No fix listed CWE-284

TI-2023-20514 CVE-2023-39375 · GHSA-hxgg-wcjc-h5jf

SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges

MEDIUM 49

SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00771 Published 2023-09-26 No fix listed CWE-274

TI-2017-04632 CVE-2017-6906 · GHSA-x39q-8jp5-jr57

An issue was discovered in SiberianCMS before 4.10.0.

LOW 29

An issue was discovered in SiberianCMS before 4.10.0.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00747 Published 2017-03-15 No fix listed CWE-79

Vulnerabilities

Filters

SiberianCMS HTTP GET Request flat cross site scripting

SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SQL injection in SiberianCMS

Unrestricted file upload in SiberianCMS

SiberianCMS - CWE-284: Improper Access Control Authorized user may disable a security feature over the network

SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges

An issue was discovered in SiberianCMS before 4.10.0.