CVE-2020-18324

Subrion CMS 4.2.1 – Kickstart 模板中的反射型 XSS 漏洞 描述 Subrion CMS 易于安装且管理简单。可将其作为独立应用程序使用，或与其他应用程序结合，用于构建入门级、中型或大型网站。 在 Subrion CMS v.4.2.1 的 "Kickstart" 网页应用模板中，通过 "search" 组件发现了反射型跨站脚本（XSS）漏洞，该漏洞允许远程攻击者注入任意 JavaScript 代码。 日期 ：2022-02-22 软件链接 ：https://subrion.org 漏洞发现者 ：HaMM0nz CVE 编号 ：CVE-2020-18324 ...

Subrion CMS <4.1.5.10 - SQL Injection

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $GET array. id: CVE-2017-11444 info: name: Subrion CMS 4.1.5.10 - SQL Injection author: dwisiswant0 severity: critical description: "Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in...

Exfiltrated-Machine-Walkthrough---Subrion-CMS-CVE-2021-2220-

Exfiltrated 机器演练 - Subrion CMS-CVE-2021-2220- 请参阅 Exfiltrated.pdf 实验室: https://portal.offsec.com/machine/exfiltrated-17398/overview/details 实验室名称: Exfiltrated 旗标: 2...

CVE-2020-18326

Subrion CMS 4.2.1 - 跨站请求伪造 CSRF（添加管理员用户） 描述 Subrion CMS 易于安装且管理简单。可将其作为独立应用程序使用，或与其他应用程序结合，用于创建入门级、中型或大型网站。 Intelliants Subrion CMS v4.2.1 的成员管理功能中存在跨站请求伪造（CSRF）漏洞，该漏洞可能允许远程未经验证的恶意用户向受害者发送一个已授权的请求，并成功创建一个任意的管理员用户。 日期 ：2022-02-27 软件链接 ：https://subrion.org 漏洞利用作者 ：HaMM0nz CVE ：CVE-2020-18326 类别： We...

CVE-2023-43875-Subrion-CMS-Reflected-XSS---Installation

Subrion CMS 反射型 XSS 漏洞 v4.2.1 作者：Sergio 描述： Subrion CMS v.4.2.1 的安装过程中存在多个跨站脚本（XSS）漏洞，本地攻击者可通过向 dbhost、dbname、dbuser、adminusername 和 adminemail 中注入精心构造的 payload 来执行任意 Web 脚本。 攻击向量： dbhost、dbname、dbuser、adminusername 和 adminemail 的安装净化过程存在漏洞，允许注入 JavaScript 代码。 POC： 在安装过程中，我们在 5 个字段中的任意一个中输入 XSS...

CVE-2020-18325

Intelliants Subrion CMS v4.2.1 配置面板中存在多个跨站脚本（XSS）漏洞 描述 Subrion CMS 易于安装且管理简单。可作为独立应用程序使用，或与其他应用程序结合使用，以建立入门级、中型或大型网站。 在 Subrion CMS v4.2.1 的配置面板中发现了多个反射型跨站脚本漏洞，远程攻击者可利用这些漏洞注入任意 JavaScript。 日期 ：2022-02-27 软件链接： https://subrion.org 漏洞作者 ：HaMM0nz CVE ：CVE-2020-18325 类别： Web 应用程序 受影响的 URL...

CVE-2026-96772

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-96773

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96773 Intelliants Subrion CMS Login Page login.php authorize redirect

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96773 Intelliants Subrion CMS Login Page login.php authorize redirect

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96773

A vulnerability exists in Intelliants Subrion CMS versions up to 4.2.1 . The flaw resides in the iaUsers::authorize function within the front/login.php file of the Login Page component. By manipulating the $_SERVER['HTTP_REFERER'] argument, a remote attacker can trigger an open redirect . Public ...

EUVD-2026-85760

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96772

A security flaw in Intelliants Subrion CMS (up to version 4.2.1 ) allows for information disclosure via a remote attack. The vulnerability exists in an unspecified part of the /actions.json?action=assign-owner endpoint, where manipulating the q argument triggers the disclosure. While an exploit h...

EUVD-2026-85759

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-96772 Intelliants Subrion CMS actions.json assign-owner information disclosure

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-96772 Intelliants Subrion CMS actions.json assign-owner information disclosure

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

PT-2026-97643

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description A security flaw allows remote information disclosure through the manipulation of the q argument. This issue occurs within the '/actions.json?action=assign-owner' endpoint...

PT-2026-97644

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description A weakness in the Login Page component allows for a remote open redirect. This occurs through the manipulation of the $ SERVER'HTTP REFERER' variable within the iaUsers::authorize...

CVE-2026-96773: URL Redirection to Untrusted Site

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96772: Exposure of Sensitive Information to an Unauthorized Actor

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...