CVE-2026-28281 | High | 7.1 | 2026-03-10 | InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderat… |
CVE-2025-59055 | Medium | 4.7 | 2025-09-11 | InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17… |
CVE-2024-50348 | Medium | 5.4 | 2024-10-29 | InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due… |
CVE-2024-31213 | Low | 3.5 | 2024-04-05 | InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after… |
CVE-2024-31212 | Medium | 6.7 | 2024-04-04 | InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrati… |
CVE-2023-4928 | High | 7.2 | 2023-09-13 | SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4879 | Medium | 4.8 | 2023-09-10 | Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git. |
CVE-2023-4878 | Medium | 5.4 | 2023-09-10 | Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4704 | Medium | 4.9 | 2023-09-01 | External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4655 | Medium | 6.1 | 2023-08-31 | Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4654 | Low | 3.5 | 2023-08-31 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4653 | Medium | 4.8 | 2023-08-31 | Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4652 | Medium | 5.4 | 2023-08-31 | Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4651 | Medium | 5.4 | 2023-08-31 | Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4650 | Medium | 4.7 | 2023-08-31 | Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4649 | Medium | 5.4 | 2023-08-31 | Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4381 | Medium | 4.3 | 2023-08-16 | Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4189 | Medium | 4.8 | 2023-08-05 | Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4188 | Critical | 9.1 | 2023-08-05 | SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4187 | Medium | 4.8 | 2023-08-05 | Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2013-6839 | | | 2013-12-13 | SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to… |