Sscms - vulnerabilities (CVEs)
19 CVEs in 2 products, 1 in the last 30 days, newest from 2026-10-16.
Products
- Siteserver Cms - 10 CVEs
- Sscms - 9 CVEs
Newest CVEs of Sscms
- CVE-2026-111658 - CVSS 5.1 (medium), 2026-10-16: SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other…
- CVE-2026-82486 - CVSS 5 (medium), 2026-08-30: A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow.…
- CVE-2026-7435 - CVSS 8.6 (high), 2026-04-30: SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without…
- CVE-2026-7429 - CVSS 4.6 (medium), 2026-04-30: SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by…
- CVE-2026-4542 - CVSS 5.4 (medium), 2026-03-22: A vulnerability has been found in SSCMS 4.7.0. The affected element is an unknown function of the file LayerImageController.Submit.cs of the component…
- CVE-2026-4234 - CVSS 6.3 (medium), 2026-03-16: A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL…
- CVE-2026-4222 - CVSS 5.1 (medium), 2026-03-16: A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file…
- CVE-2025-52237 - CVSS 6.5 (medium), 2025-08-05: An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal.
- CVE-2025-45529 - CVSS 7.1 (high), 2025-05-27: An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET…
- CVE-2023-43953 - CVSS 5.4 (medium), 2023-10-03: SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.
- CVE-2023-2862 - CVSS 6.1 (medium), 2023-05-24: A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file…
- CVE-2022-44299 - CVSS 4.9 (medium), 2023-02-16: SiteServerCMS 7.1.3 sscms has a file read vulnerability.
- CVE-2022-44298 - CVSS 9.8 (critical), 2023-01-27: SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
- CVE-2022-44297 - CVSS 9.8 (critical), 2023-01-26: SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.
- CVE-2022-30349 - CVSS 6.1 (medium), 2022-06-02: siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).
- CVE-2021-42655 - CVSS 8.8 (high), 2022-05-24: SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability.
- CVE-2021-42654 - CVSS 9.8 (critical), 2022-05-24: SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be used to execute arbitrary code.
- CVE-2021-42656 - CVSS 5.4 (medium), 2022-05-24: SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.
- CVE-2022-28118 - CVSS 9.8 (critical), 2022-05-03: SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.
