Instantcms - vulnerabilities (CVEs)
22 CVEs in 2 products, 0 in the last 30 days, newest from 2026-03-10.
Products
- Instantcms - 21 CVEs
- Icms2 - 3 CVEs
Newest CVEs of Instantcms
- CVE-2026-28281 - CVSS 7.1 (high), 2026-03-10: InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant…
- CVE-2025-59055 - CVSS 7.2 (high), 2025-09-11: InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including…
- CVE-2013-10051 - CVSS 9.8 (critical), 2025-08-01: A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() within the search view handler.…
- CVE-2024-50348 - CVSS 5.4 (medium), 2024-10-29: InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place.…
- CVE-2024-31213 - CVSS 5.4 (medium), 2024-04-05: InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after…
- CVE-2024-31212 - CVSS 7.2 (high), 2024-04-04: InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with…
- CVE-2023-4928 - CVSS 7.2 (high), 2023-09-13: SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.
- CVE-2023-4879 - CVSS 4.8 (medium), 2023-09-10: Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.
- CVE-2023-4878 - CVSS 5.4 (medium), 2023-09-10: Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- CVE-2023-4704 - CVSS 8.8 (high), 2023-09-01: External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- CVE-2023-4652 - CVSS 6.8 (medium), 2023-08-31: Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- CVE-2023-4655 - CVSS 6.1 (medium), 2023-08-31: Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.
- CVE-2023-4654 - CVSS 3.5 (low), 2023-08-31: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.
- CVE-2023-4653 - CVSS 5.9 (medium), 2023-08-31: Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- CVE-2023-4649 - CVSS 5.4 (medium), 2023-08-31: Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.
- CVE-2023-4651 - CVSS 6.4 (medium), 2023-08-31: Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.
- CVE-2023-4650 - CVSS 4.7 (medium), 2023-08-31: Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- CVE-2023-4381 - CVSS 4.3 (medium), 2023-08-16: Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- CVE-2023-4189 - CVSS 4.8 (medium), 2023-08-05: Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- CVE-2023-4188 - CVSS 9.8 (critical), 2023-08-05: SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- CVE-2023-4187 - CVSS 4.8 (medium), 2023-08-05: Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- CVE-2018-14382 - CVSS 6.1 (medium), 2018-07-18: InstantCMS 2.10.1 has /redirect?url= XSS.
