Phpwcms
by Phpwcms
Source repositories
CVEs (23)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-36424 | Cri | 0.64 | 9.8 | 0.01 | Feb 3, 2023 | An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation. | ||
| CVE-2020-21784 | Cri | 0.64 | 9.8 | 0.01 | Jun 24, 2021 | phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php. | ||
| CVE-2021-36426 | Hig | 0.57 | 8.8 | 0.01 | Feb 3, 2023 | File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php. | ||
| CVE-2025-5499 | Hig | 0.48 | 7.3 | 0.01 | Jun 3, 2025 | A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack… | ||
| CVE-2020-19855 | Med | 0.40 | 6.1 | 0.01 | Sep 8, 2021 | phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php. | ||
| CVE-2025-5498 | Med | 0.36 | 5.5 | 0.00 | Jun 3, 2025 | A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of the file include/inc_lib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the… | ||
| CVE-2021-47783 | Med | 0.35 | 5.4 | 0.00 | Jan 16, 2026 | Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks… | ||
| CVE-2021-36425 | Med | 0.35 | 5.4 | 0.01 | Feb 3, 2023 | Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file. | ||
| CVE-2018-12990 | Med | 0.35 | 5.3 | 0.01 | Jun 30, 2018 | phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field. | ||
| CVE-2025-5497 | Med | 0.34 | 6.3 | 0.01 | Jun 3, 2025 | A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in… | ||
| CVE-2017-15872 | Med | 0.31 | 4.8 | 0.01 | Oct 24, 2017 | phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmpl.php and include/inc_tmpl/admin.newuser.tmpl.php via the username (aka new_login) field. | ||
| CVE-2007-5185 | 0.06 | — | 0.42 | Oct 3, 2007 | Multiple PHP remote file inclusion vulnerabilities in phpWCMS XT 0.0.7 BETA and earlier allow remote attackers to execute arbitrary PHP code via a URL in the HTML_MENU_DirPath parameter to (1) config_HTML_MENU.php and (2) config_PHPLM.php in… | |||
| CVE-2005-3789 | 0.03 | — | 0.03 | Nov 24, 2005 | Multiple directory traversal vulnerabilities in phpwcms 1.2.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) form_lang parameter in login.php and (2) the imgdir parameter in random_image.php. | |||
| CVE-2005-3790 | 0.03 | — | 0.02 | Nov 24, 2005 | Multiple cross-site scripting (XSS) vulnerabilities in act_newsletter.php in phpwcms 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) i and (2) text parameters. | |||
| CVE-2021-4301 | Med | 0.00 | 6.3 | 0.01 | Jan 7, 2023 | A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version… | ||
| CVE-2021-4302 | Low | 0.00 | 3.5 | 0.01 | Jan 4, 2023 | A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version… | ||
| CVE-2011-3789 | 0.00 | — | 0.01 | Sep 24, 2011 | phpwcms 1.4.7 r412 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by template/inc_script/frontend_render/disabled/majonavi.php and certain other files. | |||
| CVE-2006-7020 | 0.00 | — | 0.01 | Feb 15, 2007 | CRLF injection vulnerability in (1) include/inc_act/act_formmailer.php and possibly (2) sample_ext_php/mail_file_form.php in phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to modify HTTP headers and send spam e-mail via a spoofed HTTP Referer… | |||
| CVE-2006-7018 | 0.00 | — | 0.04 | Feb 15, 2007 | phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via a crafted argument to the nome_evento parameter to phpwcms_code_snippets/mail_file_form.php and (2) sample_ext_php/mail_file_form.php, which is processed by the… | |||
| CVE-2006-7019 | 0.00 | — | 0.02 | Feb 15, 2007 | phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via crafted arguments to the (1) text_evento and (2) email_eventonome_evento parameters to phpwcms_code_snippets/mail_file_form.php and sample_ext_php/mail_file_form.php, which… |
- risk 0.64cvss 9.8epss 0.01
An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.
- risk 0.64cvss 9.8epss 0.01
phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.
- risk 0.57cvss 8.8epss 0.01
File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php.
- risk 0.48cvss 7.3epss 0.01
A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack…
- risk 0.40cvss 6.1epss 0.01
phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php.
- risk 0.36cvss 5.5epss 0.00
A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of the file include/inc_lib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the…
- risk 0.35cvss 5.4epss 0.00
Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks…
- risk 0.35cvss 5.4epss 0.01
Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file.
- risk 0.35cvss 5.3epss 0.01
phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.
- risk 0.34cvss 6.3epss 0.01
A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in…
- risk 0.31cvss 4.8epss 0.01
phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmpl.php and include/inc_tmpl/admin.newuser.tmpl.php via the username (aka new_login) field.
- CVE-2007-5185Oct 3, 2007risk 0.06cvss —epss 0.42
Multiple PHP remote file inclusion vulnerabilities in phpWCMS XT 0.0.7 BETA and earlier allow remote attackers to execute arbitrary PHP code via a URL in the HTML_MENU_DirPath parameter to (1) config_HTML_MENU.php and (2) config_PHPLM.php in…
- CVE-2005-3789Nov 24, 2005risk 0.03cvss —epss 0.03
Multiple directory traversal vulnerabilities in phpwcms 1.2.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) form_lang parameter in login.php and (2) the imgdir parameter in random_image.php.
- CVE-2005-3790Nov 24, 2005risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in act_newsletter.php in phpwcms 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) i and (2) text parameters.
- risk 0.00cvss 6.3epss 0.01
A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version…
- risk 0.00cvss 3.5epss 0.01
A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version…
- CVE-2011-3789Sep 24, 2011risk 0.00cvss —epss 0.01
phpwcms 1.4.7 r412 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by template/inc_script/frontend_render/disabled/majonavi.php and certain other files.
- CVE-2006-7020Feb 15, 2007risk 0.00cvss —epss 0.01
CRLF injection vulnerability in (1) include/inc_act/act_formmailer.php and possibly (2) sample_ext_php/mail_file_form.php in phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to modify HTTP headers and send spam e-mail via a spoofed HTTP Referer…
- CVE-2006-7018Feb 15, 2007risk 0.00cvss —epss 0.04
phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via a crafted argument to the nome_evento parameter to phpwcms_code_snippets/mail_file_form.php and (2) sample_ext_php/mail_file_form.php, which is processed by the…
- CVE-2006-7019Feb 15, 2007risk 0.00cvss —epss 0.02
phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via crafted arguments to the (1) text_evento and (2) email_eventonome_evento parameters to phpwcms_code_snippets/mail_file_form.php and sample_ext_php/mail_file_form.php, which…
Page 1 of 2