Expressionengine
9 CVEs across 1 Expressionengine products. Browse Expressionengine vulnerabilities, severities, and proof-of-concept exploits.
Expressionengine products with known CVEs
Expressionengine CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-59473 | High | 7.2 | 2026-01-26 | SQL Injection vulnerability in the Structure for Admin authenticated user |
CVE-2024-38454 | Medium | 6.1 | 2024-06-16 | ExpressionEngine before 7.4.11 allows XSS. |
CVE-2021-44534 | Medium | 6.5 | 2024-05-31 | Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosure.
|
CVE-2023-22953 | High | 8.8 | 2023-02-09 | In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user. |
CVE-2020-8242 | High | 7.2 | 2022-02-18 | Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel… |
CVE-2021-33199 | Critical | 9.8 | 2021-08-12 | In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file na… |
CVE-2021-27230 | High | 8.8 | 2021-03-15 | ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _… |
CVE-2020-13443 | High | 8.8 | 2020-06-24 | ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft… |
CVE-2018-17874 | Medium | 6.1 | 2018-10-01 | ExpressionEngine before 4.3.5 has reflected XSS. |
CVE-2017-1000160 | Medium | 5.4 | 2017-11-17 | EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection |
CVE-2017-0897 | High | 7.5 | 2017-06-22 | ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to rem… |
CVE-2014-5387 | | | 2014-11-04 | Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1)… |
CVE-2009-1070 | | | 2009-03-26 | Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6, and possibly earlier versions, allows remote attackers to… |
CVE-2008-0202 | | | 2008-01-10 | CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP respo… |
CVE-2008-0201 | | | 2008-01-10 | Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via… |