CVE-2019-11406

Subrion CMS 4.2.1 allows core/en/contacts/ XSS via the name, email, or phone parameter...

CVE-2019-11406

CVE-2019-11406 affects Subrion CMS 4.2.1. The vulnerability is a Cross‑Site Scripting (XSS) in the _core/en/contacts/ path, exploitable via the name, email, or phone parameter in the contacts page. According to the records, exploitation requires user interaction (UI: REQUIRED) per CVSS3; base sco...

Subrion CMS Cross-Site Request Forgery Vulnerability (CNVD-2019-13091)

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site request forgery vulnerability exists in Subrion CMS version 4.1.5. The vulnerability stems from the WEB...

CVE-2017-18366

Subrion CMS 4.1.5 has CSRF in blog/delete/...

CVE-2017-18366

Subrion CMS 4.1.5 has CSRF in blog/delete/...

Cross site request forgery (csrf)

Subrion CMS 4.1.5 has CSRF in blog/delete/...

CVE-2017-18366

Subrion CMS 4.1.5 has CSRF in blog/delete/...

CVE-2017-18366

CVE-2017-18366 relates to Subrion CMS 4.1.5 and is a CSRF in the blog/delete/ action. The Red Hat and GitHub advisory records corroborate a CSRF vulnerability in Subrion CMS 4.1.5 and note mitigations have been applied in a newer release. The issue originates from insufficient CSRF protections, e...

Cross-Site Scripting (XSS)

intelliants/subrion CMS is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the Site Title parameter in panel/configuration/general, to steal session tokens or perform unwanted action on behalf of the user...

Cross-site Scripting (XSS)

intelliants/subrion is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of safe default configuration for serving svg files, allowing persisted XSS attacks...

Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2018-25034)

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A cross-site scripting vulnerability exists in Subrion CMS version 4.2.1. A remote attacker can exploit th...

Design/Logic Flaw

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter...

CVE-2018-16631

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter...

CVE-2018-16629

panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

Design/Logic Flaw

panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

CVE-2018-16631

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter...

CVE-2018-16629

panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

CVE-2018-16629

panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

CVE-2018-16631

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter...

CVE-2018-16629

CVE-2018-16629 describes an XSS vulnerability in Subrion CMS v4.2.1, triggered by an SVG file containing JavaScript in a SCRIPT element uploaded to the path panel/uploads/#elf_l1_XA. The core issue is an SVG handling path that allows script execution, enabling potential arbitrary code execution w...