- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 42 · 1 high, 5 medium, 1 low
- Registry
- Packagist
Advisories 42
- CVE-2026-12202Medium 4.8
Intelliants Subrion CMS Blocks Endpoint cross site scripting
Affected: through 4.0.3.
- CVE-2025-70958Medium 6.1
Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute…
Affected: through 4.2.1.
- CVE-2025-56556Low 3.8
An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query…
Affected: through 4.2.1.
- CVE-2024-25399Medium 6.1
Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.
Affected: through 4.2.1.
- CVE-2023-46947High 8.8
Subrion 4.2.1 has a remote command execution vulnerability in the backend.
Affected: through 4.2.1.
- CVE-2023-43875Unrated
Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary…
Affected: through 4.2.1.
- CVE-2023-43884Unrated
A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute…
Affected: through 4.2.1.
- CVE-2023-43830Unrated
A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web…
Affected: through 4.2.1.
- CVE-2023-43828Unrated
A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML…
Affected: through 4.2.1.
- CVE-2022-43121Medium 6.1
A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute…
Affected: through 4.2.1.
- CVE-2022-43120Medium 6.1
A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to…
Affected: through 4.2.1.
- CVE-2022-37059Unrated
Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field
Affected: through 4.2.1.
- CVE-2021-41502Unrated
An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious…
Affected: through 4.2.1.
- CVE-2021-41948Unrated
A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".
Affected: through 4.2.1.
- CVE-2021-43464Unrated
A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is…
Affected: through 4.2.1.
Show all 42 advisoriesShow fewer advisories
- CVE-2020-18325Unrated
Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.
Affected: through 4.2.1.
- CVE-2020-18324Unrated
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.
Affected: through 4.2.1.
- CVE-2020-18326Unrated
Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which…
Affected: through 4.2.1.
- CVE-2020-22330Unrated
Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.
Affected: from 4.2.1, fixed in 4.2.2.
- CVE-2020-22392Unrated
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
Affected: through 4.2.1.
- CVE-2020-18155Unrated
SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
Affected: through 4.2.1.
- CVE-2020-23761Unrated
Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the…
Affected: through 4.2.1.
- CVE-2019-7357Unrated
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/.
Affected: through 4.2.1.
- CVE-2019-20390Unrated
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the…
Affected: versions 4.2.1.
- CVE-2019-20389Unrated
An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page.
Affected: through 4.2.1.
- CVE-2020-12467Unrated
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.
Affected: through 4.2.1.
- CVE-2020-12468Unrated
Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language.
Affected: versions 4.2.1.
- CVE-2020-12469Unrated
admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the…
Affected: through 4.2.1.
- CVE-2018-21037Unrated
Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.
Affected: fixed in 4.2.1.
- CVE-2018-11317Unrated
Subrion CMS before 4.1.4 has XSS.
Affected: fixed in 4.1.4.
- CVE-2017-18366Unrated
Subrion CMS 4.1.5 has CSRF in blog/delete/.
Affected: fixed in 4.2.1.
- CVE-2018-16629Unrated
panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
Affected: through 4.2.1.
- CVE-2018-19422Unrated
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess…
Affected: fixed in 4.2.2.
- CVE-2018-15563Unrated
_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.
Affected: through 4.2.1.
- CVE-2018-16327Unrated
There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.
Affected: versions 4.2.1.
- CVE-2018-14840Unrated
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file…
Affected: fixed in 4.2.2.
- CVE-2018-14835Unrated
Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.
Affected: through 4.2.1.
- CVE-2017-15063Unrated
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error.
Affected: from 4.1, fixed in 4.2.0.
- CVE-2017-10795Unrated
Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body…
Affected: fixed in 4.1.6.
- CVE-2017-6068Unrated
Subrion CMS 4.0.5 has CSRF in admin/blocks/add/.
Affected: through 4.0.5.
- CVE-2017-5543Unrated
includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted…
Affected: from 4.0.5, fixed in 4.1.0.
- CVE-2014-9120Unrated
Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via…
Affected: fixed in 3.2.3.