CVE-2021-47976 | High | 8.8 | 2026-05-16 | TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the pl… |
CVE-2021-47943 | High | 8.8 | 2026-05-10 | TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious P… |
CVE-2026-30452 | Medium | 6.5 | 2026-04-21 | Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to mo… |
CVE-2026-32986 | Medium | 6.1 | 2026-03-20 | Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improp… |
CVE-2023-53911 | Medium | 5.4 | 2025-12-17 | Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to inject malicious scr… |
CVE-2023-50038 | High | 8.8 | 2023-12-28 | There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions. |
CVE-2023-36220 | High | 7.2 | 2023-08-07 | Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive infor… |
CVE-2023-24269 | High | 8.8 | 2023-04-28 | An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file. |
CVE-2023-26852 | High | 7.2 | 2023-04-12 | An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted P… |
CVE-2021-40642 | Medium | 4.3 | 2022-06-29 | Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php… |
CVE-2021-40658 | Medium | 4.8 | 2022-06-14 | Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content>Write>Body”. |
CVE-2021-44082 | High | 8.3 | 2022-03-29 | textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger rem… |
CVE-2021-28002 | Medium | 5.4 | 2021-08-19 | A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbit… |
CVE-2021-28001 | Medium | 5.4 | 2021-08-19 | A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code… |
CVE-2020-23239 | Medium | 4.8 | 2021-07-26 | Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature. |
CVE-2020-19510 | Critical | 9.8 | 2021-06-21 | Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php. |
CVE-2021-30209 | Medium | 6.5 | 2021-04-15 | Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may… |
CVE-2020-35854 | Medium | 4.8 | 2021-01-26 | Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter. |
CVE-2020-29458 | High | 8.8 | 2020-12-02 | Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem. |
CVE-2015-8033 | Medium | 5.3 | 2020-08-14 | In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account. |
CVE-2015-8032 | Medium | 5.3 | 2020-08-14 | In Textpattern 4.5.7, an unprivileged author can change an article's markup setting. |
CVE-2018-7474 | Critical | 9.8 | 2018-03-14 | An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php. |
CVE-2018-1000090 | High | 7.5 | 2018-03-13 | textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web serve… |
CVE-2014-4737 | | | 2014-10-10 | Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to se… |
CVE-2011-5019 | | | 2012-01-05 | Cross-site scripting (XSS) vulnerability in setup/index.php in Textpattern CMS 4.4.1, when the product is incompletely installed, allows remote attackers to in… |
CVE-2011-3807 | | | 2011-09-24 | Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error… |
CVE-2010-3205 | | | 2010-09-03 | PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parame… |
CVE-2008-5757 | | | 2008-12-30 | Cross-site scripting (XSS) vulnerability in textarea/index.php in Textpattern (aka Txp CMS) 4.0.6 and earlier allows remote authenticated users to inject arbit… |
CVE-2008-5670 | | | 2008-12-19 | Textpattern (aka Txp CMS) 4.0.5 does not ask for the old password during a password reset, which makes it easier for remote attackers to change a password afte… |
CVE-2008-5669 | | | 2008-12-19 | index.php in the comments preview section in Textpattern (aka Txp CMS) 4.0.5 allows remote attackers to cause a denial of service via a long message parameter. |
CVE-2008-5668 | | | 2008-12-19 | Multiple cross-site scripting (XSS) vulnerabilities in Textpattern (aka Txp CMS) 4.0.5 allow remote attackers to inject arbitrary web script or HTML via (1) th… |
CVE-2006-5615 | | | 2006-10-31 | PHP remote file inclusion vulnerability in publish.php in Textpattern 1.19, when register_globals is enabled, allows remote attackers to execute arbitrary PHP… |