Intelliants Subrion
26 CVEs affecting Intelliants Subrion. Latest disclosed: 2026-08-05. Critical: 3, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25400 | Critical | 9.8 | 2024-02-27 | Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. NOTE: this is disputed by multiple third parties because it refers to an HTTP request… |
CVE-2020-18155 | Critical | 9.8 | 2021-07-14 | SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection. |
CVE-2017-5543 | Critical | 9.8 | 2017-01-20 | includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt c… |
CVE-2023-46947 | High | 8.8 | 2023-11-03 | Subrion 4.2.1 has a remote command execution vulnerability in the backend. |
CVE-2018-21037 | High | 8.8 | 2020-03-17 | Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI. |
CVE-2017-15063 | High | 8.8 | 2017-10-06 | There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF… |
CVE-2019-20390 | High | 8.1 | 2020-05-15 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a vic… |
CVE-2020-12468 | High | 7.8 | 2020-04-29 | Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/. |
CVE-2026-71292 | High | 7.2 | 2026-08-05 | Subrion CMS's admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.admin.php, whitelists the `dir` (ASC/DESC) request parameter… |
CVE-2020-12469 | Medium | 6.5 | 2020-04-29 | admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a blo… |
CVE-2020-12467 | Medium | 6.5 | 2020-04-29 | Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie. |
CVE-2020-22330 | Medium | 6.1 | 2021-08-06 | Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. |
CVE-2020-23761 | Medium | 6.1 | 2021-04-09 | Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" colu… |
CVE-2019-20389 | Medium | 6.1 | 2020-05-15 | An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the… |
CVE-2018-11317 | Medium | 6.1 | 2019-07-03 | Subrion CMS before 4.1.4 has XSS. |
CVE-2018-15563 | Medium | 6.1 | 2018-10-02 | _core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter. |
CVE-2018-14840 | Medium | 6.1 | 2018-08-02 | uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads). |
CVE-2017-10795 | Medium | 6.1 | 2017-07-02 | Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a diffe… |
CVE-2023-43884 | Medium | 5.4 | 2023-09-28 | A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or… |
CVE-2023-43830 | Medium | 5.4 | 2023-09-27 | A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a… |