Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: SiteServer Clear all filters
TI-2026-75444 CVE-2026-111658 · GHSA-f64v-vg62-99f4

SiteServer SSCMS authorization bypass exposes other sites' channels

Priority MEDIUM 56

SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00325 Published 2026-10-16 No fix listed CWE-639
TI-2026-06536 CVE-2026-7435 · GHSA-vhhj-g588-8p4h

SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString

Priority HIGH 72

SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00535 Published 2026-04-30 No fix listed CWE-89
TI-2026-06532 CVE-2026-7429 · GHSA-h9g3-q89c-mhwg

SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing

Priority MEDIUM 44

SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and…

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00203 Published 2026-04-30 No fix listed CWE-79
TI-2023-02682 CVE-2023-2862 · GHSA-63c6-w556-3h7q

SiteServer CMS search cross site scripting

Priority LOW 28

A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00561 Published 2023-05-24 No fix listed CWE-79