CVE-2021-36605

engineercms 1.03 is affected by a Cross-Site Scripting (XSS) vulnerability in the nickname field on the user list page due to lack of escaping. When an admin or user views the page, the embedded JavaScript can be executed in the attacker’s browser, potentially compromising user sessions or creden...

CVE-2025-44830

The EngineerCMS data management platform (v1.02 through v2.0.5) contains a SQL injection vulnerability in the /project/addprojtemplet interface. An attacker can inject malicious SQL commands to manipulate database queries, potentially leading to unauthorized access or modification of sensitive da...

CVE-2025-44831

The EngineerCMS data management platform (versions v1.02 through v2.0.5 ) is vulnerable to a SQL injection vulnerability within the /project/addproject interface. This flaw allows an attacker to inject malicious SQL commands to manipulate database queries, potentially leading to unauthorized acce...