Intelliants Subrion_cms
36 CVEs affecting Intelliants Subrion_cms. Latest disclosed: 2026-02-02. Critical: 3, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-11445 | Critical | 9.8 | 2017-07-19 | Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array. |
CVE-2017-11444 | Critical | 9.8 | 2017-07-19 | Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array. |
CVE-2017-6013 | Critical | 9.8 | 2017-03-27 | Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter. |
CVE-2021-43464 | High | 8.8 | 2022-04-04 | A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in… |
CVE-2020-18326 | High | 8.8 | 2022-03-04 | Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unaut… |
CVE-2019-7357 | High | 8.8 | 2020-11-10 | Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins. |
CVE-2017-18366 | High | 8.8 | 2019-04-15 | Subrion CMS 4.1.5 has CSRF in blog/delete/. |
CVE-2017-6069 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter. |
CVE-2017-6068 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter. |
CVE-2017-6066 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter. |
CVE-2017-6002 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry, and can optionally insert XSS into that entry via the body parameter. |
CVE-2021-41947 | High | 7.2 | 2021-10-08 | A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode. |
CVE-2018-19422 | High | 7.2 | 2018-11-21 | /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. |
CVE-2025-70958 | Medium | 6.1 | 2026-02-02 | Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript… |
CVE-2024-25399 | Medium | 6.1 | 2024-02-27 | Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. |
CVE-2023-43875 | Medium | 6.1 | 2023-10-19 | Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a craft… |
CVE-2022-43121 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2022-43120 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scrip… |
CVE-2020-18325 | Medium | 6.1 | 2022-03-04 | Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. |
CVE-2020-18324 | Medium | 6.1 | 2022-03-04 | Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. |