Vulnerabilities

TI-2020-19211 CVE-2020-37076 · GHSA-xwhw-cvrw-c9g5

Victor CMS 1.0 - 'post' SQL Injection

HIGH 77

Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00434 Published 2026-02-03 No fix listed CWE-89

TI-2020-19208 CVE-2020-37073 · GHSA-pgrm-rf8r-q98p

Victor CMS 1.0 - Authenticated Arbitrary File Upload

MEDIUM 40

Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with arbitrary content through the user_image parameter.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.0056 Published 2026-02-03 No fix listed CWE-434

TI-2020-19207 CVE-2020-37072 · GHSA-v5w7-x5c5-8hg8

Victor CMS 1.0 - 'comment_author' Persistent Cross-Site Scripting

MEDIUM 62

Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows attackers to inject malicious scripts.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00285 Published 2026-02-03 No fix listed CWE-79

TI-2020-19077 CVE-2020-36942 · GHSA-3j3v-hh5m-2442

Victor CMS 1.0 - File Upload To RCE

MEDIUM 41

Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00711 Published 2026-01-27 No fix listed CWE-434

TI-2020-14744 CVE-2020-23966 · GHSA-mm96-9vx8-pfhj

SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary…

HIGH 82

SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafted GET request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0084 Published 2023-05-08 No fix listed CWE-89

TI-2020-18099 CVE-2020-35597 · GHSA-vrcv-w2wx-vq9w

Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of…

MEDIUM 41

Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit_user.php, and edit parameter of admin_update_categories.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01541 Published 2022-06-16 No fix listed CWE-89

TI-2022-10885 CVE-2022-28060 · GHSA-675h-c34q-8v9h

SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php.

LOW 36

SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01595 Published 2022-04-28 No fix listed CWE-89

TI-2022-10493 CVE-2022-27478 · GHSA-qvvf-p6r3-ww25

Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the…

MEDIUM 57

Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.20013 Published 2022-04-21 No fix listed CWE-434

TI-2022-09628 CVE-2022-26201 · GHSA-mgf5-m389-fxh9

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.

MEDIUM 45

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01495 Published 2022-03-04 No fix listed CWE-89

TI-2022-07870 CVE-2022-23873 · GHSA-44ff-mg3w-w3pw

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows…

MEDIUM 41

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01281 Published 2022-02-03 No fix listed CWE-89

TI-2021-21250 CVE-2021-46459 · GHSA-8frf-c859-r46q

Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the…

LOW 36

Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0137 Published 2022-01-31 No fix listed CWE-89

TI-2021-21249 CVE-2021-46458 · GHSA-g28w-5r28-fx2r

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component…

LOW 36

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0137 Published 2022-01-31 No fix listed CWE-89

TI-2021-07463 CVE-2021-25203 · GHSA-xwch-xg3p-x5q5

Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute…

MEDIUM 46

Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\admin_add_post.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01874 Published 2021-07-23 No fix listed CWE-434

TI-2020-17625 CVE-2020-29280 · GHSA-qpxg-jggc-73jp

The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.

MEDIUM 46

The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01898 Published 2020-12-02 No fix listed CWE-89

TI-2020-14740 CVE-2020-23945 · GHSA-9q2m-8p9j-9x39

A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the…

LOW 35

A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the category.php file.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01168 Published 2020-10-27 No fix listed CWE-89

TI-2020-12274 CVE-2020-15599 · GHSA-2943-53pm-phm4

Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.

LOW 31

Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02114 Published 2020-07-07 No fix listed CWE-79

TI-2018-12012 CVE-2018-16775 · GHSA-6q73-4fmp-2jp7

An issue was discovered in Victor CMS through 2018-05-10.

LOW 23

An issue was discovered in Victor CMS through 2018-05-10.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00534 Published 2018-09-10 No fix listed CWE-79

TI-2018-11130 CVE-2018-15603 · GHSA-g7vx-xpxv-6552

An issue was discovered in Victor CMS through 2018-05-10.

LOW 28

An issue was discovered in Victor CMS through 2018-05-10.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00647 Published 2018-08-21 No fix listed CWE-79

Vulnerabilities

Filters