Xoops - vulnerabilities (CVEs)

88 CVEs in 44 products, 0 in the last 30 days, newest from 2026-02-22.

Products

Newest CVEs of Xoops

CVE-2019-25433 - CVSS 8.8 (high), 2026-02-22: XOOPS CMS 2.5.9 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the…
CVE-2023-36217 - CVSS 9 (critical), 2023-08-03: Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 allows a remote attacker to execute arbitrary code via the category name field of the image manager…
CVE-2019-16683 - CVSS 4.8 (medium), 2019-09-30: An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a…
CVE-2019-16684 - CVSS 4.8 (medium), 2019-09-30: An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is hovered over in the list or in the Edit…
CVE-2017-12139 - CVSS 6.1 (medium), 2017-08-02: XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php.
CVE-2017-12138 - CVSS 6.1 (medium), 2017-08-02: XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.
CVE-2017-11174 - CVSS 9.8 (critical), 2017-07-12: In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the…
CVE-2017-7944 - CVSS 6.1 (medium), 2017-04-24: XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in page_dbsettings.php.
CVE-2017-7290 - CVSS 7.2 (high), 2017-03-30: SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands…
CVE-2014-8999 - CVSS 6.5 (medium), 2014-11-20: SQL injection vulnerability in htdocs/modules/system/admin.php in XOOPS before 2.5.7 Final allows remote authenticated users to execute arbitrary SQL commands…
CVE-2012-0984 - CVSS 4.3 (medium), 2014-09-11: Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid…
CVE-2014-3935 - CVSS 7.5 (high), 2014-06-02: SQL injection vulnerability in glossaire-aff.php in the Glossaire module 1.0 for XOOPS allows remote attackers to execute arbitrary SQL commands via the…
CVE-2011-4565 - CVSS 4.3 (medium), 2011-11-28: Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.5.1.a, and possibly earlier versions, allow remote attackers to inject arbitrary web script or…
CVE-2011-3822 - CVSS 5 (medium), 2011-09-24: XOOPS 2.5.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error…
CVE-2009-4851 - CVSS 5 (medium), 2010-05-07: The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows…
CVE-2009-4582 - CVSS 7.5 (high), 2010-01-06: SQL injection vulnerability in detail.php in the Dictionary module for XOOPS 2.0.18 allows remote attackers to execute arbitrary SQL commands via the id…
CVE-2009-3963 - CVSS 7.5 (high), 2009-11-17: Multiple unspecified vulnerabilities in XOOPS before 2.4.0 Final have unknown impact and attack vectors.
CVE-2008-7178 - CVSS 7.5 (high), 2009-09-08: Directory traversal vulnerability in Uploader module 1.1 for XOOPS allows remote attackers to read arbitrary files via a .. (dot dot) in the filename…
CVE-2009-2783 - CVSS 4.3 (medium), 2009-08-17: Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the (1) op parameter to…
CVE-2008-6885 - CVSS 4.3 (medium), 2009-07-31: Cross-site scripting (XSS) vulnerability in pmlite.php in XOOPS 2.3.1 and 2.3.2a allows remote attackers to inject arbitrary web script or HTML via a STYLE…
CVE-2008-6884 - CVSS 6.8 (medium), 2009-07-31: Multiple directory traversal vulnerabilities in XOOPS 2.3.1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local…
CVE-2008-5665 - CVSS 7.5 (high), 2008-12-19: SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL commands via the no parameter.
CVE-2008-4653 - CVSS 7.5 (high), 2008-10-22: SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote attackers to execute arbitrary SQL…
CVE-2008-3560 - CVSS 4.3 (medium), 2008-08-08: Cross-site scripting (XSS) vulnerability in kshop_search.php in the Kshop module 2.22 for Xoops allows remote attackers to inject arbitrary web script or HTML…
CVE-2008-3296 - CVSS 7.5 (high), 2008-07-25: Directory traversal vulnerability in modules/system/admin.php in XOOPS 2.0.18 1 allows remote attackers to include and execute arbitrary local files via a ..…
CVE-2008-3295 - CVSS 4.3 (medium), 2008-07-25: Cross-site scripting (XSS) vulnerability in modules/system/admin.php in XOOPS 2.0.18.1 allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2008-2094 - CVSS 7.5 (high), 2008-05-06: SQL injection vulnerability in article.php in the Article module for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-2035 - CVSS 4.3 (medium), 2008-04-30: Cross-site scripting (XSS) vulnerability in the Bluemoon, Inc. (1) BackPack 0.91 and earlier, (2) BmSurvey 0.84 and earlier, (3) newbb_fileup 1.83 and…
CVE-2008-1351 - CVSS 7.5 (high), 2008-03-17: SQL injection vulnerability in the Tutorials 2.1b module for XOOPS allows remote attackers to execute arbitrary SQL commands via the tid parameter to…
CVE-2008-1065 - CVSS 7.5 (high), 2008-02-28: Multiple SQL injection vulnerabilities in index.php in the XM-Memberstats (xmmemberstats) 2.0e module for XOOPS allow remote attackers to execute arbitrary…