Easycms

12 CVEs across 1 Easycms products. Browse Easycms vulnerabilities, severities, and proof-of-concept exploits.

Easycms products with known CVEs

Product	CVEs
Easycms	12

Easycms CVEs — newest first
CVE	Severity	Score	Published	Summary
`CVE-2026-3786`	Medium	`6.3`	2026-03-08	A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Re…
`CVE-2026-3785`	Medium	`6.3`	2026-03-08	A vulnerability was identified in EasyCMS up to 1.6. The affected element is an unknown function of the file /RbacnodeAction.class.php of the component Request…
`CVE-2026-1105`	High	`7.3`	2026-01-18	A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argume…
`CVE-2022-23358`	Critical	`9.8`	2022-02-16	EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used direc…
`CVE-2020-24271`	High	`8.8`	2021-02-01	A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/clo…
`CVE-2019-6294`	High	`8.8`	2019-01-15	An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI.
`CVE-2018-17113`	Medium	`6.1`	2018-09-17	App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter, a related issue to…
`CVE-2018-16773`	Medium	`4.8`	2018-09-10	EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field.
`CVE-2018-16759`	Medium	`6.1`	2018-09-09	The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange ev…
`CVE-2018-16345`	High	`8.8`	2018-09-02	An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listus…
`CVE-2018-12971`	Medium	`6.5`	2018-06-29	EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.
`CVE-2018-10374`	Medium	`6.1`	2018-04-25	EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html request.