Expressionengine

15 CVEs across 1 Expressionengine products. Browse Expressionengine vulnerabilities, severities, and proof-of-concept exploits.

Expressionengine products with known CVEs

ProductCVEs
Expressionengine15
Expressionengine CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-59473High7.22026-01-26SQL Injection vulnerability in the Structure for Admin authenticated user
CVE-2024-38454Medium6.12024-06-16ExpressionEngine before 7.4.11 allows XSS.
CVE-2021-44534Medium6.52024-05-31Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosure.
CVE-2023-22953High8.82023-02-09In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
CVE-2020-8242High7.22022-02-18Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel…
CVE-2021-33199Critical9.82021-08-12In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file na…
CVE-2021-27230High8.82021-03-15ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _…
CVE-2020-13443High8.82020-06-24ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft…
CVE-2018-17874Medium6.12018-10-01ExpressionEngine before 4.3.5 has reflected XSS.
CVE-2017-1000160Medium5.42017-11-17EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection
CVE-2017-0897High7.52017-06-22ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to rem…
CVE-2014-53872014-11-04Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1)…
CVE-2009-10702009-03-26Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6, and possibly earlier versions, allows remote attackers to…
CVE-2008-02022008-01-10CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP respo…
CVE-2008-02012008-01-10Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via…