CVE-2021-47783 | Medium | 5.4 | 2026-01-16 | Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can u… |
CVE-2025-5499 | High | 7.3 | 2025-06-03 | A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_… |
CVE-2025-5498 | Medium | 5.5 | 2025-06-03 | A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of… |
CVE-2025-5497 | Medium | 6.3 | 2025-06-03 | A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport… |
CVE-2021-36426 | High | 8.8 | 2023-02-03 | File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php. |
CVE-2021-36425 | Medium | 5.4 | 2023-02-03 | Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include… |
CVE-2021-36424 | Critical | 9.8 | 2023-02-03 | An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation. |
CVE-2021-4301 | Medium | 6.3 | 2023-01-07 | A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation o… |
CVE-2021-4302 | Low | 3.5 | 2023-01-04 | A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handl… |
CVE-2020-19855 | Medium | 6.1 | 2021-09-08 | phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php. |
CVE-2020-21784 | Critical | 9.8 | 2021-06-24 | phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php. |
CVE-2018-12990 | Medium | 5.3 | 2018-06-30 | phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field. |
CVE-2017-15872 | Medium | 4.8 | 2017-10-24 | phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmpl.php and include/inc_tmpl/admin.newuser.tmpl.php via the username (aka new_login) field. |
CVE-2011-3789 | | | 2011-09-24 | phpwcms 1.4.7 r412 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error… |
CVE-2006-7019 | | | 2007-02-15 | phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via crafted arguments to the (1) text_evento and (2) email… |
CVE-2006-6886 | | | 2006-12-31 | phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for (1) files.public-userroot.inc.php or (2) files.private.addit… |
CVE-2006-2519 | | | 2006-05-22 | Directory traversal vulnerability in include/inc_ext/spaw/spaw_control.class.php in phpwcms 1.2.5-DEV allows remote attackers to include arbitrary local files… |
CVE-2006-2518 | | | 2006-05-22 | Cross-site scripting (XSS) vulnerability in phpwcms 1.2.5-DEV allows remote attackers to inject arbitrary web script or HTML via the BL[be_cnt_plainhtml] param… |
CVE-2005-3790 | | | 2005-11-24 | Multiple cross-site scripting (XSS) vulnerabilities in act_newsletter.php in phpwcms 1.2.5 allow remote attackers to inject arbitrary web script or HTML via th… |
CVE-2005-3789 | | | 2005-11-24 | Multiple directory traversal vulnerabilities in phpwcms 1.2.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) form_lang parameter… |