Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 70

Export CSV
CVE-2018-21037

Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Intelliants
Products
Subrion
CVE-2018-19422

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

CVSS 3.1 · 7.2 High EPSS 64.5% KEV · Not listed
Vendors
Intelliants
Products
Subrion Cms
CVE-2018-16629

panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Intelliants
Products
Subrion Cms
CVE-2018-16327

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Intelliants
Products
Subrion
CVE-2018-15563

_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Intelliants
Products
Subrion
CVE-2018-14840

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).

CVSS 3.0 · 6.1 Medium EPSS 3.7% KEV · Not listed
Vendors
Intelliants
Products
Subrion