GHSA-C8MG-WP7H-F2PF Subrion CMS XSS

Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas...

Subrion CMS XSS

Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas...

Subrion CMS CSRF Vulnerability

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...

GHSA-RC94-7V55-WMG6 Subrion CMS CSRF Vulnerability

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...

Subrion Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in Subrion CMS allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069...

GHSA-2XV7-FWH6-X7FC Subrion Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in Subrion CMS allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069...

Subrion CMS Cross-site Scripting

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...

GHSA-VHQR-3GR2-7PX9 Subrion CMS Cross-site Scripting

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...

Subrion CMS PHP Object Injection

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

Subrion CMS Cross-site scripting in search

A cross-site scripting XSS vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to subrion/search/...

GHSA-4J79-4M6Q-77VF Subrion CMS PHP Object Injection

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

GHSA-XJR9-2WF2-3V4W Subrion CMS Cross-site scripting in search

A cross-site scripting XSS vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to subrion/search/...

GHSA-6WC4-V4V5-3M82 Subrion CMS Stored Cross-site Scripting (XSS)

core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...

Subrion CMS Stored Cross-site Scripting (XSS)

core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...

Subrion Cross-site Scripting (XSS)

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...

GHSA-9738-C49Q-4RGC Subrion Cross-site Scripting (XSS)

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...

Subrion CMS XSS

panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

GHSA-MXV3-QCMF-R6WJ Subrion CMS XSS

panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

GHSA-Q4H5-G3W8-F9X7 Subrion CMS vulnerable to CSRF in admin/blocks/add

Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter...

Subrion CMS vulnerable to CSRF in admin/blocks/add

Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter...