# impresscms/impresscms (Packagist) vulnerabilities

13 known vulnerabilities, with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/impresscms/impresscms

## Advisories (13)

### [CVE-2023-37785](https://cve.now/CVE-2023-37785): A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a…

- Severity: Unrated
- Published: Jul 13, 2023
- Affected: through 1.4.5.

### [CVE-2022-26986](https://cve.now/CVE-2022-26986): SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker…

- Severity: Unrated
- Published: Apr 5, 2022
- Affected: through 1.4.3.

### [CVE-2021-26601](https://cve.now/CVE-2021-26601): ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image\_temp Directory Traversal.

- Severity: Unrated
- Published: Mar 28, 2022
- Affected: fixed in 1.4.3.

### [CVE-2021-26600](https://cve.now/CVE-2021-26600): ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).

- Severity: Unrated
- Published: Mar 28, 2022
- Affected: fixed in 1.4.3.

### [CVE-2021-26599](https://cve.now/CVE-2021-26599): ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.

- Severity: Unrated
- Published: Mar 28, 2022
- Affected: fixed in 1.4.3.

### [CVE-2021-26598](https://cve.now/CVE-2021-26598): ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by…

- Severity: Unrated
- Published: Mar 28, 2022
- Affected: fixed in 1.4.3.

### [CVE-2022-24977](https://cve.now/CVE-2022-24977): ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to…

- Severity: Unrated
- Published: Feb 13, 2022
- Affected: fixed in 1.4.2.

### [CVE-2021-28088](https://cve.now/CVE-2021-28088): Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary…

- Severity: Unrated
- Published: Mar 11, 2021
- Affected: through 1.4.2.

### [CVE-2020-17551](https://cve.now/CVE-2020-17551): ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.

- Severity: Unrated
- Published: Oct 7, 2020
- Affected: fixed in 1.4.1.

### [CVE-2018-13983](https://cve.now/CVE-2018-13983): ImpressCMS 1.3.10 has XSS via the PATH\_INFO to htdocs/install/index.php, htdocs/install/page\_langselect.php, or…

- Severity: Unrated
- Published: May 6, 2019
- Affected: through 1.3.10.

### [CVE-2014-1836](https://cve.now/CVE-2014-1836): Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers…

- Severity: Unrated
- Published: Jul 1, 2015
- Affected: fixed in 1.3.6.

### [CVE-2014-4036](https://cve.now/CVE-2014-4036): Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web…

- Severity: Unrated
- Published: Jun 11, 2014
- Affected: through 1.3.6.1.

### [CVE-2010-4616](https://cve.now/CVE-2010-4616): Cross-site scripting (XSS) vulnerability in modules/content/admin/content.php in ImpressCMS 1.2.3 Final, and possibly other versions…

- Severity: Unrated
- Published: Dec 29, 2010
- Affected: fixed in 1.2.4.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/impresscms/impresscms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.