Phpwcms - vulnerabilities (CVEs)
20 CVEs in 1 products, 1 in the last 30 days, newest from 2026-10-13.
Products
- Phpwcms - 20 CVEs
Newest CVEs of Phpwcms
- CVE-2026-110025 - CVSS 7.3 (high), 2026-10-13: A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file…
- CVE-2021-47783 - CVSS 5.4 (medium), 2026-01-16: Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can…
- CVE-2025-5498 - CVSS 7.2 (high), 2025-06-03: A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of…
- CVE-2025-5499 - CVSS 9.8 (critical), 2025-06-03: A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file…
- CVE-2025-5497 - CVSS 9.8 (critical), 2025-06-03: A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file…
- CVE-2021-36425 - CVSS 5.4 (medium), 2023-02-03: Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in…
- CVE-2021-36424 - CVSS 9.8 (critical), 2023-02-03: An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.
- CVE-2021-36426 - CVSS 8.8 (high), 2023-02-03: File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php.
- CVE-2021-4301 - CVSS 9.8 (critical), 2023-01-07: A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation…
- CVE-2021-4302 - CVSS 6.1 (medium), 2023-01-04: A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File…
- CVE-2020-19855 - CVSS 6.1 (medium), 2021-09-08: phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php.
- CVE-2020-21784 - CVSS 9.8 (critical), 2021-06-24: phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.
- CVE-2018-12990 - CVSS 5.3 (medium), 2018-06-30: phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.
- CVE-2017-15872 - CVSS 4.8 (medium), 2017-10-24: phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmpl.php and include/inc_tmpl/admin.newuser.tmpl.php via the username (aka new_login) field.
- CVE-2011-3789 - CVSS 5 (medium), 2011-09-24: phpwcms 1.4.7 r412 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an…
- CVE-2006-7019 - CVSS 7.5 (high), 2007-02-15: phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via crafted arguments to the (1) text_evento and (2)…
- CVE-2006-6886 - CVSS 5 (medium), 2006-12-31: phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for (1) files.public-userroot.inc.php or (2)…
- CVE-2006-2519 - CVSS 2.6 (low), 2006-05-22: Directory traversal vulnerability in include/inc_ext/spaw/spaw_control.class.php in phpwcms 1.2.5-DEV allows remote attackers to include arbitrary local files…
- CVE-2006-2518 - CVSS 2.6 (low), 2006-05-22: Cross-site scripting (XSS) vulnerability in phpwcms 1.2.5-DEV allows remote attackers to inject arbitrary web script or HTML via the BL[be_cnt_plainhtml]…
- CVE-2005-3789 - CVSS 5 (medium), 2005-11-24: Multiple directory traversal vulnerabilities in phpwcms 1.2.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) form_lang parameter…
