Subrion CMS
by Intelliants
Source repositories
CVEs (65)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-17225 | Med | 0.38 | 5.4 | 0.02 | Oct 6, 2019 | Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue. | ||
| CVE-2018-14840 | Med | 0.36 | 6.1 | 0.04 | Aug 2, 2018 | uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads). | ||
| CVE-2023-43884 | Med | 0.35 | 5.4 | 0.00 | Sep 28, 2023 | A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' parameter. | ||
| CVE-2023-43830 | Med | 0.35 | 5.4 | 0.01 | Sep 27, 2023 | A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum deposit', 'Maximum deposit' and/or 'Maximum balance'. | ||
| CVE-2023-43828 | Med | 0.35 | 5.4 | 0.01 | Sep 27, 2023 | A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter. | ||
| CVE-2021-41502 | Med | 0.35 | 5.4 | 0.01 | Jun 11, 2022 | An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or adding the onerror attribute. | ||
| CVE-2021-41948 | Med | 0.35 | 5.4 | 0.00 | Apr 29, 2022 | A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects". | ||
| CVE-2020-22392 | Med | 0.35 | 5.4 | 0.01 | Aug 5, 2021 | Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file. | ||
| CVE-2019-7356 | Med | 0.35 | 5.4 | 0.01 | Nov 4, 2020 | Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter. | ||
| CVE-2018-16631 | Med | 0.35 | 5.4 | 0.01 | Dec 4, 2018 | Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter. | ||
| CVE-2020-22330 | Med | 0.33 | 6.1 | 0.01 | Aug 6, 2021 | Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. | ||
| CVE-2022-37059 | Med | 0.31 | 4.8 | 0.01 | Aug 29, 2022 | Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field | ||
| CVE-2021-43724 | Med | 0.31 | 4.8 | 0.00 | Feb 24, 2022 | A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file. | ||
| CVE-2025-56556 | Low | 0.25 | 3.8 | 0.00 | Sep 11, 2025 | An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel - to gain escalated privileges in the context of the SQL query tool. | ||
| CVE-2018-16629 | Med | 0.24 | 4.8 | 0.01 | Dec 4, 2018 | panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. | ||
| CVE-2018-16327 | Med | 0.24 | 4.8 | 0.01 | Sep 1, 2018 | There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration. | ||
| CVE-2026-12202 | Low | 0.09 | 2.4 | 0.00 | Jun 15, 2026 | A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. Such manipulation of the argument CSS class name leads to cross site scripting. The attack may be launched remotely. The… | ||
| CVE-2012-5452 | 0.03 | — | 0.05 | Oct 22, 2012 | Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multi_title parameter to blocks/add/; (2) cost, (3) days, or (4) title[en] parameter to plans/add/; (5) name or (6) title[en]… | |||
| CVE-2012-4773 | 0.03 | — | 0.03 | Oct 22, 2012 | Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an… | |||
| CVE-2012-4772 | 0.03 | — | 0.04 | Oct 22, 2012 | SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the plan_id parameter. |
- risk 0.38cvss 5.4epss 0.02
Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.
- risk 0.36cvss 6.1epss 0.04
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
- risk 0.35cvss 5.4epss 0.00
A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' parameter.
- risk 0.35cvss 5.4epss 0.01
A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum deposit', 'Maximum deposit' and/or 'Maximum balance'.
- risk 0.35cvss 5.4epss 0.01
A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or adding the onerror attribute.
- risk 0.35cvss 5.4epss 0.00
A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
- risk 0.35cvss 5.4epss 0.01
Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.
- risk 0.35cvss 5.4epss 0.01
Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.
- risk 0.33cvss 6.1epss 0.01
Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.
- risk 0.31cvss 4.8epss 0.01
Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field
- risk 0.31cvss 4.8epss 0.00
A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file.
- risk 0.25cvss 3.8epss 0.00
An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel - to gain escalated privileges in the context of the SQL query tool.
- risk 0.24cvss 4.8epss 0.01
panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
- risk 0.24cvss 4.8epss 0.01
There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.
- risk 0.09cvss 2.4epss 0.00
A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. Such manipulation of the argument CSS class name leads to cross site scripting. The attack may be launched remotely. The…
- CVE-2012-5452Oct 22, 2012risk 0.03cvss —epss 0.05
Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multi_title parameter to blocks/add/; (2) cost, (3) days, or (4) title[en] parameter to plans/add/; (5) name or (6) title[en]…
- CVE-2012-4773Oct 22, 2012risk 0.03cvss —epss 0.03
Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an…
- CVE-2012-4772Oct 22, 2012risk 0.03cvss —epss 0.04
SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the plan_id parameter.
Page 3 of 4