CVE-2026-73679 | High | 7.2 | 2026-08-14 | ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary… |
CVE-2021-47938 | High | 8.8 | 2026-05-10 | ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitr… |
CVE-2019-25703 | High | 7.1 | 2026-04-12 | ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL c… |
CVE-2022-50912 | Critical | 9.8 | 2026-01-13 | ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers c… |
CVE-2023-37785 | Medium | 4.8 | 2023-07-13 | A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2022-26986 | High | 7.2 | 2022-04-05 | SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the… |
CVE-2021-26601 | High | 8.1 | 2022-03-28 | ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal. |
CVE-2021-26600 | Critical | 9.8 | 2022-03-28 | ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==). |
CVE-2021-26599 | Critical | 9.8 | 2022-03-28 | ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection. |
CVE-2021-26598 | Medium | 5.3 | 2022-03-28 | ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have… |
CVE-2022-24977 | Critical | 9.8 | 2022-02-14 | ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction w… |
CVE-2021-28088 | Medium | 5.4 | 2021-03-11 | Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML para… |
CVE-2020-17551 | Medium | 4.8 | 2020-10-07 | ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution. |
CVE-2018-13983 | Medium | 6.1 | 2019-05-06 | ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck.php. |
CVE-2014-1836 | | | 2015-07-01 | Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary fi… |
CVE-2014-4036 | | | 2014-06-11 | Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via t… |
CVE-2012-0987 | | | 2012-10-06 | Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remote authenticated users to incl… |
CVE-2012-0986 | | | 2012-10-06 | Multiple cross-site scripting (XSS) vulnerabilities in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allow remote attackers to inject arbitr… |
CVE-2010-4616 | | | 2010-12-29 | Cross-site scripting (XSS) vulnerability in modules/content/admin/content.php in ImpressCMS 1.2.3 Final, and possibly other versions before 1.2.4, allows remot… |
CVE-2010-4271 | | | 2010-11-17 | SQL injection vulnerability in ImpressCMS before 1.2.3 RC2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
CVE-2008-6360 | | | 2009-03-02 | Cross-site scripting (XSS) vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbit… |
CVE-2008-5964 | | | 2009-01-23 | Session fixation vulnerability in Social ImpressCMS before 1.1.1 RC1 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter. |
CVE-2008-3453 | | | 2008-08-04 | Multiple unspecified vulnerabilities in ImpressCMS 1.0 have unknown impact and attack vectors, related to modules/admin.php and "a few files." |