# gilacms/gila (Packagist) vulnerabilities

8 known vulnerabilities (1 high, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/gilacms/gila

## Advisories (8)

### [CVE-2020-26625](https://cve.now/CVE-2020-26625): A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web…

- Severity: Low 3.8
- Published: Jan 2, 2024
- Affected: through 1.15.4.

### [CVE-2020-26624](https://cve.now/CVE-2020-26624): A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web…

- Severity: Low 3.8
- Published: Jan 2, 2024
- Affected: through 1.15.4.

### [CVE-2020-26623](https://cve.now/CVE-2020-26623): SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the…

- Severity: Low 3.8
- Published: Jan 2, 2024
- Affected: through 1.15.4.

### [CVE-2020-20523](https://cve.now/CVE-2020-20523): Cross Site Scripting (XSS) vulnerability in adm\_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary…

- Severity: Unrated
- Published: Aug 11, 2023
- Affected: fixed in 1.11.4.

### [CVE-2020-20726](https://cve.now/CVE-2020-20726): Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the…

- Severity: High 8.8
- Published: Jun 20, 2023
- Affected: through 1.11.4.

### [CVE-2020-20693](https://cve.now/CVE-2020-20693): A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts.

- Severity: Unrated
- Published: Sep 27, 2021
- Affected: through 1.11.4.

### [CVE-2020-20696](https://cve.now/CVE-2020-20696): A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or…

- Severity: Unrated
- Published: Sep 27, 2021
- Affected: through 1.11.4.

### [CVE-2020-20695](https://cve.now/CVE-2020-20695): A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a…

- Severity: Unrated
- Published: Sep 27, 2021
- Affected: through 1.11.4.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/gilacms/gila
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.