723 matches found
Subrion CMS <4.1.5.10 - SQL Injection
Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $GET array. id: CVE-2017-11444 info: name: Subrion CMS 4.1.5.10 - SQL Injection author: dwisiswant0 severity: critical description: "Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in...
CVE-2020-18325
Множественная уязвимость межсайтового скриптинга XSS существует в панели конфигурации Intelliants Subrion CMS v4.2.1. Описание Subrion CMS легко устанавливается и прост в управлении. Используйте его как отдельное приложение или в сочетании с другими приложениями для создания сайтов начального,...
CVE-2023-43875-Subrion-CMS-Reflected-XSS---Installation
Subrion CMS: отражённая XSS v4.2.1 Автор: Sergio Описание: Множественные уязвимости межсайтового выполнения сценариев XSS в процессе установки Subrion CMS v.4.2.1 позволяют локальному злоумышленнику выполнять произвольные веб-сценарии с помощью специально созданного пейлоада, внедряемого в dbhost...
CVE-2020-18326
Subrion CMS 4.2.1 - Межсайтовая подделка запроса CSRF Добавление пользователя-администратора Описание Subrion CMS прост в установке и удобен в управлении. Используйте его как автономное приложение или в сочетании с другими приложениями для создания сайтов начального уровня, средних или крупных...
CVE-2020-18324
Subrion CMS 4.2.1 – Отражённая XSS-уязвимость в шаблоне Kickstart Описание Subrion CMS прост в установке и удобен в управлении. Используйте его как автономное приложение или в сочетании с другими приложениями для создания сайтов начального уровня, средних или крупных сайтов. Уязвимость отражённог...
Exfiltrated-Machine-Walkthrough---Subrion-CMS-CVE-2021-2220-
Прохождение машины Exfiltrated - Subrion CMS-CVE-2021-2220- См. Exfiltrated.pdf Лаборатория: https://portal.offsec.com/machine/exfiltrated-17398/overview/details Название лаборатории: Exfiltrated Флаги: 2...
CVE-2026-72604
A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...
CVE-2026-72604 Intelliants Subrion CMS - Path Traversal
A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...
CVE-2026-72604 Intelliants Subrion CMS - Path Traversal
A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...
EUVD-2026-56043
A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...
CVE-2026-72604
CVE-2026-72604 affects Intelliants Subrion CMS up to version 4.2.1. A path traversal flaw in the admin panel file deletion endpoint allows an authenticated administrator to pass a user-supplied path to unlink() without sanitization or path canonicalization, enabling deletion of arbitrary files ou...
CVE-2026-72604
A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...
PT-2026-70148
Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file pa...
CVE-2026-71292
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...
CVE-2026-71292
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...
CVE-2026-71292 Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...
CVE-2026-71292
CVE-2026-71292 affects Subrion CMS. The admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.admin.php, accepts a sort parameter by falling back to the attacker-controlled GET value when the key isn’t in the per-controller $_gridSorting whitelist. The value is then ...
CVE-2026-71292 Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...
EUVD-2026-53377
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the dir ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied sort GET parameter whenever the requested key is not present in the per-controller...
CVE-2026-71292 Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...