Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

impresscms/impresscms

13 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
13
Registry
Packagist

Advisories 13

  • A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a…

    Affected: through 1.4.5.

  • SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker…

    Affected: through 1.4.3.

  • ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.

    Affected: fixed in 1.4.3.

  • ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).

    Affected: fixed in 1.4.3.

  • ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.

    Affected: fixed in 1.4.3.

  • ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by…

    Affected: fixed in 1.4.3.

  • ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to…

    Affected: fixed in 1.4.2.

  • Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary…

    Affected: through 1.4.2.

  • ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.

    Affected: fixed in 1.4.1.

  • ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or…

    Affected: through 1.3.10.

  • Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers…

    Affected: fixed in 1.3.6.

  • Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web…

    Affected: through 1.3.6.1.

  • Cross-site scripting (XSS) vulnerability in modules/content/admin/content.php in ImpressCMS 1.2.3 Final, and possibly other versions…

    Affected: fixed in 1.2.4.