CVE-2019-17046

CVE-2019-17046 affects Ilch 2.1.22. The vulnerability arises because PHP is listed under “Allowed files” on the index.php/admin/media/settings/index page, enabling remote code execution. The issue is documented across multiple feeds (NVD, Red Hat, CNVD, osv.dev, CVE listings) as a remote code exe...

CVE-2019-17045

The CVE-2019-17045 entry concerns Ilch CMS 2.1.22 with a stored XSS in the Jobs Tab, exploitable via the title, text, or email id fields. Root cause cited by CNVD-2019-42862 is lack of proper validation of client-side data. Consequences include execution of client-side code in authenticated conte...

CVE-2014-1944

CVE-2014-1944 describes a Cross-Site Scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier. The issue arises from insufficient sanitisation of the HTTP POST parameter text sent to /index.php/guestbook/index/newentry, allowing a remote unauthenticated user to inject arbitrary HTML/script that ...

CVE-2021-27352

Ilch CMS version 2.1.42 contains an open redirect vulnerability that enables an attacker to redirect authenticated users to an attacker‑controlled site after login. The CVE-2021-27352 entry is reflected across multiple sources, but the connected documents do not provide concrete exploit steps or ...

CVE-2019-20523

CVE-2019-20523 affects ilchCMS 2.1.23, where an XSS vulnerability exists in the index.php/partner/index Name parameter. The issue allows injection of script into client-side context, as described in public sources. The NVD entry lists an overall impact of low to partial integrity impact (I:L) wit...

CVE-2019-20522

CVE-2019-20522 affects ilchCMS 2.1.23 and enables Cross-Site Scripting via the index.php/partner/index Link parameter. The connected sources consistently describe a client-side script execution vulnerability in ilchCMS, with no details provided on affected versions beyond 2.1.23 in public CVE rec...

CVE-2019-20524

CVE-2019-20524 affects ilchCMS 2.1.23 and allows cross-site scripting via the Banner parameter in index.php/partner/index. The root cause is a reflected XSS vector that exposes client-side code execution opportunities when a banner parameter is manipulated, as described across multiple sources (e...