Intelliants Subrion_cms
14 CVEs affecting Intelliants Subrion_cms. Latest disclosed: 2017-07-19. Critical: 3, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-11445 | Critical | 9.8 | 2017-07-19 | Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array. |
CVE-2017-11444 | Critical | 9.8 | 2017-07-19 | Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array. |
CVE-2017-6013 | Critical | 9.8 | 2017-03-27 | Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter. |
CVE-2017-6069 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter. |
CVE-2017-6068 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter. |
CVE-2017-6066 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter. |
CVE-2017-6002 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry, and can optionally insert XSS into that entry via the body parameter. |
CVE-2015-4129 | | 2015-07-05 | SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a s… | |
CVE-2012-5452 | | 2012-10-22 | Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multi_title… | |
CVE-2012-4773 | | 2012-10-22 | Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators fo… | |
CVE-2012-4772 | | 2012-10-22 | SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the plan_id parameter. | |
CVE-2012-4771 | | 2012-10-22 | Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the id parame… | |
CVE-2011-5212 | | 2012-10-22 | SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the (1) user name or (2) pass… | |
CVE-2011-5211 | | 2012-10-22 | Cross-site scripting (XSS) vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the title f… |