CVE-2026-72604 | Medium | 6.5 | 2026-08-11 | A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the adm… |
CVE-2026-71292 | High | 7.2 | 2026-08-05 | Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_a… |
CVE-2026-12202 | Low | 2.4 | 2026-06-15 | A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. S… |
CVE-2025-70958 | Medium | 6.1 | 2026-02-02 | Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript… |
CVE-2025-56556 | Low | 3.8 | 2025-09-11 | An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQ… |
CVE-2024-25400 | Critical | 9.8 | 2024-02-27 | Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. NOTE: this is disputed by multiple third parties because it refers to an HTTP request… |
CVE-2024-25399 | Medium | 6.1 | 2024-02-27 | Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. |
CVE-2023-46947 | High | 8.8 | 2023-11-03 | Subrion 4.2.1 has a remote command execution vulnerability in the backend. |
CVE-2023-43875 | Medium | 6.1 | 2023-10-19 | Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a craft… |
CVE-2023-43884 | Medium | 5.4 | 2023-09-28 | A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or… |
CVE-2023-43830 | Medium | 5.4 | 2023-09-27 | A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2023-43828 | Medium | 5.4 | 2023-09-27 | A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2022-43121 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2022-43120 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scrip… |
CVE-2022-37059 | Medium | 4.8 | 2022-08-29 | Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field |
CVE-2021-41502 | Medium | 5.4 | 2022-06-11 | An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifyin… |
CVE-2021-41948 | Medium | 5.4 | 2022-04-29 | A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects". |
CVE-2021-43464 | High | 8.8 | 2022-04-04 | A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in… |
CVE-2020-18326 | High | 8.8 | 2022-03-04 | Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unaut… |
CVE-2020-18325 | Medium | 6.1 | 2022-03-04 | Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. |
CVE-2020-18324 | Medium | 6.1 | 2022-03-04 | Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. |
CVE-2021-43724 | Medium | 4.8 | 2022-02-24 | A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file. |
CVE-2021-41947 | High | 7.2 | 2021-10-08 | A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode. |
CVE-2020-22330 | Medium | 6.1 | 2021-08-06 | Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. |
CVE-2020-22392 | Medium | 5.4 | 2021-08-05 | Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file. |
CVE-2020-18155 | Critical | 9.8 | 2021-07-14 | SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection. |
CVE-2020-23761 | Medium | 6.1 | 2021-04-09 | Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" colu… |
CVE-2020-35437 | Medium | 6.1 | 2020-12-26 | Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the /_core/profile/ URI. |
CVE-2019-7357 | High | 8.8 | 2020-11-10 | Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins. |
CVE-2019-7356 | Medium | 5.4 | 2020-11-04 | Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter. |
CVE-2019-20390 | High | 8.1 | 2020-05-15 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a vic… |
CVE-2019-20389 | Medium | 6.1 | 2020-05-15 | An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the… |
CVE-2020-12469 | Medium | 6.5 | 2020-04-29 | admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a blo… |
CVE-2020-12468 | High | 7.8 | 2020-04-29 | Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/. |
CVE-2020-12467 | Medium | 6.5 | 2020-04-29 | Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie. |
CVE-2018-21037 | High | 8.8 | 2020-03-17 | Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI. |
CVE-2019-17225 | Medium | 5.4 | 2019-10-06 | Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue. |
CVE-2018-11317 | Medium | 6.1 | 2019-07-03 | Subrion CMS before 4.1.4 has XSS. |
CVE-2019-11406 | Medium | 6.1 | 2019-05-08 | Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter. |
CVE-2017-18366 | High | 8.8 | 2019-04-15 | Subrion CMS 4.1.5 has CSRF in blog/delete/. |
CVE-2018-16631 | Medium | 5.4 | 2018-12-04 | Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter. |
CVE-2018-16629 | Medium | 4.8 | 2018-12-04 | panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. |
CVE-2018-19422 | High | 7.2 | 2018-11-21 | /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. |
CVE-2018-15563 | Medium | 6.1 | 2018-10-02 | _core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter. |
CVE-2018-16327 | Medium | 4.8 | 2018-09-01 | There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration. |
CVE-2018-14840 | Medium | 6.1 | 2018-08-02 | uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads). |
CVE-2017-15063 | High | 8.8 | 2017-10-06 | There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF… |
CVE-2017-11445 | Critical | 9.8 | 2017-07-19 | Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array. |
CVE-2017-11444 | Critical | 9.8 | 2017-07-19 | Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array. |
CVE-2017-10795 | Medium | 6.1 | 2017-07-02 | Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a diffe… |
CVE-2017-6069 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter. |
CVE-2017-6068 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter. |
CVE-2017-6066 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter. |
CVE-2017-6013 | Critical | 9.8 | 2017-03-27 | Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter. |
CVE-2017-6002 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry, and can optionally insert XSS into that entry via the body parameter. |
CVE-2017-5543 | Critical | 9.8 | 2017-01-20 | includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt c… |
CVE-2015-4129 | | | 2015-07-05 | SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a s… |
CVE-2014-9120 | | | 2014-12-10 | Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to subrio… |
CVE-2012-5452 | | | 2012-10-22 | Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multi_title… |
CVE-2012-4773 | | | 2012-10-22 | Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators fo… |
CVE-2012-4772 | | | 2012-10-22 | SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the plan_id parameter. |
CVE-2012-4771 | | | 2012-10-22 | Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the id parame… |
CVE-2011-5212 | | | 2012-10-22 | SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the (1) user name or (2) pass… |
CVE-2011-5211 | | | 2012-10-22 | Cross-site scripting (XSS) vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the title f… |
CVE-2010-4504 | | | 2010-12-08 | Multiple cross-site scripting (XSS) vulnerabilities in eSyndiCat Directory 2.3 allow remote attackers to inject arbitrary web script or HTML via the title para… |
CVE-2008-6924 | | | 2009-08-10 | Multiple cross-site scripting (XSS) vulnerabilities in register.php in eSyndiCat Directory 2.2 allow remote attackers to inject arbitrary web script or HTML vi… |
CVE-2009-1659 | | | 2009-05-18 | Unrestricted file upload vulnerability in admin/uploadimage.php in eLitius 1.0 allows remote attackers to bypass intended access restrictions and upload and ex… |
CVE-2009-1506 | | | 2009-05-01 | SQL injection vulnerability in classes/Xp.php in eLitius 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to banner-details.p… |