CVE-2021-36605

engineercms 1.03 is affected by a Cross-Site Scripting (XSS) vulnerability in the nickname field on the user list page due to lack of escaping. When an admin or user views the page, the embedded JavaScript can be executed in the attacker’s browser, potentially compromising user sessions or creden...

CVE-2025-44830

Affected software. EngineerCMS v1.02–v2.0.5. Vulnerability. SQL injection in the /project/addprojtemplet interface. Root cause is an injectable SQL pathway in that endpoint, enabling manipulation of database queries. Impact (as stated). High confidentiality, integrity, and availability impact (CV...

CVE-2025-44831

EngineerCMS v1.02–v2.0.5 contains a SQL injection vulnerability in the /project/addproject interface. Multiple sources confirm the affected versions and the injection pathway, with evidence describing the vulnerability as allowing arbitrary SQL commands through that endpoint. The root cause is an...