Subrion CMS CSRF Vulnerability

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site request forgery vulnerability exists in Subrion CMS version 4.1.5 previous versions may also be affected....

CVE-2018-21037: Cross-Site Request Forgery (CSRF)

Subrion CMS 4.1.5 and possibly earlier versions allow CSRF to change the administrator password via the panel/members/edit/1 URI...

CVE-2019-17225: Improper Neutralization of Input During Web Page Generation

Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue...