Phpcms
Products
3- 19 CVEs
- 1 CVE
- 1 CVE
Recent CVEs
20| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-14399 | Cri | 0.64 | 9.8 | 0.01 | Jul 19, 2018 | libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI in the SRC attribute of an IMG element within info[content] JSON data to the index.php?m=member&c=index&a=register URI. | ||
| CVE-2018-14940 | Hig | 0.49 | 7.5 | 0.01 | Aug 5, 2018 | PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkcode request. | ||
| CVE-2018-19127 | 0.07 | — | 0.21 | Nov 9, 2018 | A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a… | |||
| CVE-2006-3019 | 0.04 | — | 0.08 | Jun 15, 2006 | Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in parser/include/ including (1) class.parser_phpcms.php, (2) class.session_phpcms.php, (3)… | |||
| CVE-2011-0645 | 0.03 | — | 0.01 | Jan 25, 2011 | SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the where_time parameter in a get action. | |||
| CVE-2011-0644 | 0.03 | — | 0.01 | Jan 25, 2011 | SQL injection vulnerability in include/admin/model_field.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the modelid parameter to flash_upload.php. | |||
| CVE-2008-0513 | 0.03 | — | 0.04 | Jan 31, 2008 | Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to parser/parser.php, as demonstrated by a filename ending with %00.gif, a different vector than… | |||
| CVE-2025-25960 | 0.00 | — | 0.00 | Feb 20, 2025 | Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator. | |||
| CVE-2025-25958 | 0.00 | — | 0.00 | Feb 20, 2025 | Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script. | |||
| CVE-2021-36425 | 0.00 | — | 0.01 | Feb 3, 2023 | Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file. | |||
| CVE-2021-40910 | 0.00 | — | 0.01 | Jun 15, 2022 | There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side. | |||
| CVE-2020-22203 | 0.00 | — | 0.01 | Jun 16, 2021 | SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php. | |||
| CVE-2020-22201 | 0.00 | — | 0.01 | Jun 16, 2021 | phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php. | |||
| CVE-2020-22200 | 0.00 | — | 0.01 | Jun 16, 2021 | Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword. | |||
| CVE-2020-22199 | 0.00 | — | 0.01 | Jun 16, 2021 | SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php. | |||
| CVE-2019-10027 | 0.00 | — | 0.01 | Mar 24, 2019 | PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen. | |||
| CVE-2013-5939 | 0.00 | — | 0.02 | May 14, 2014 | Multiple cross-site scripting (XSS) vulnerabilities in the Guestbook module for PHPCMS allow remote attackers to inject arbitrary web script or HTML via the (1) list or (2) introduce parameter to index.php. | |||
| CVE-2005-1840 | 0.00 | — | 0.02 | Jun 2, 2005 | Directory traversal vulnerability in class.layout_phpcms.php in phpCMS 1.2.x before 1.2.1pl2 allows remote attackers to read or include arbitrary files, as demonstrated using a .. (dot dot) in the language parameter to parser.php. | |||
| CVE-2004-1202 | 0.00 | — | 0.02 | Jan 10, 2005 | Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter. | |||
| CVE-2004-1203 | 0.00 | — | 0.01 | Jan 10, 2005 | parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to gain sensitive information via an invalid file parameter, which reveals the web server's installation path. |
- risk 0.64cvss 9.8epss 0.01
libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI in the SRC attribute of an IMG element within info[content] JSON data to the index.php?m=member&c=index&a=register URI.
- risk 0.49cvss 7.5epss 0.01
PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkcode request.
- CVE-2018-19127Nov 9, 2018risk 0.07cvss —epss 0.21
A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a…
- CVE-2006-3019Jun 15, 2006risk 0.04cvss —epss 0.08
Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in parser/include/ including (1) class.parser_phpcms.php, (2) class.session_phpcms.php, (3)…
- CVE-2011-0645Jan 25, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the where_time parameter in a get action.
- CVE-2011-0644Jan 25, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in include/admin/model_field.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the modelid parameter to flash_upload.php.
- CVE-2008-0513Jan 31, 2008risk 0.03cvss —epss 0.04
Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to parser/parser.php, as demonstrated by a filename ending with %00.gif, a different vector than…
- CVE-2025-25960Feb 20, 2025risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator.
- CVE-2025-25958Feb 20, 2025risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script.
- CVE-2021-36425Feb 3, 2023risk 0.00cvss —epss 0.01
Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file.
- CVE-2021-40910Jun 15, 2022risk 0.00cvss —epss 0.01
There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.
- CVE-2020-22203Jun 16, 2021risk 0.00cvss —epss 0.01
SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php.
- CVE-2020-22201Jun 16, 2021risk 0.00cvss —epss 0.01
phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php.
- CVE-2020-22200Jun 16, 2021risk 0.00cvss —epss 0.01
Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword.
- CVE-2020-22199Jun 16, 2021risk 0.00cvss —epss 0.01
SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php.
- CVE-2019-10027Mar 24, 2019risk 0.00cvss —epss 0.01
PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.
- CVE-2013-5939May 14, 2014risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the Guestbook module for PHPCMS allow remote attackers to inject arbitrary web script or HTML via the (1) list or (2) introduce parameter to index.php.
- CVE-2005-1840Jun 2, 2005risk 0.00cvss —epss 0.02
Directory traversal vulnerability in class.layout_phpcms.php in phpCMS 1.2.x before 1.2.1pl2 allows remote attackers to read or include arbitrary files, as demonstrated using a .. (dot dot) in the language parameter to parser.php.
- CVE-2004-1202Jan 10, 2005risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
- CVE-2004-1203Jan 10, 2005risk 0.00cvss —epss 0.01
parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to gain sensitive information via an invalid file parameter, which reveals the web server's installation path.