# intelliants/subrion (Packagist) vulnerabilities 42 known vulnerabilities (1 high, 5 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/intelliants/subrion ## Advisories (42) ### [CVE-2026-12202](https://cve.now/CVE-2026-12202): Intelliants Subrion CMS Blocks Endpoint cross site scripting - Severity: Medium 4.8 - Published: Jun 15, 2026 - Affected: through 4.0.3. ### [CVE-2025-70958](https://cve.now/CVE-2025-70958): Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute… - Severity: Medium 6.1 - Published: Feb 2, 2026 - Affected: through 4.2.1. ### [CVE-2025-56556](https://cve.now/CVE-2025-56556): An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query… - Severity: Low 3.8 - Published: Sep 11, 2025 - Affected: through 4.2.1. ### [CVE-2024-25399](https://cve.now/CVE-2024-25399): Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. - Severity: Medium 6.1 - Published: Feb 27, 2024 - Affected: through 4.2.1. ### [CVE-2023-46947](https://cve.now/CVE-2023-46947): Subrion 4.2.1 has a remote command execution vulnerability in the backend. - Severity: High 8.8 - Published: Nov 3, 2023 - Affected: through 4.2.1. ### [CVE-2023-43875](https://cve.now/CVE-2023-43875): Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary… - Severity: Unrated - Published: Oct 19, 2023 - Affected: through 4.2.1. ### [CVE-2023-43884](https://cve.now/CVE-2023-43884): A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute… - Severity: Unrated - Published: Sep 28, 2023 - Affected: through 4.2.1. ### [CVE-2023-43830](https://cve.now/CVE-2023-43830): A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web… - Severity: Unrated - Published: Sep 27, 2023 - Affected: through 4.2.1. ### [CVE-2023-43828](https://cve.now/CVE-2023-43828): A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML… - Severity: Unrated - Published: Sep 27, 2023 - Affected: through 4.2.1. ### [CVE-2022-43121](https://cve.now/CVE-2022-43121): A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute… - Severity: Medium 6.1 - Published: Nov 9, 2022 - Affected: through 4.2.1. ### [CVE-2022-43120](https://cve.now/CVE-2022-43120): A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to… - Severity: Medium 6.1 - Published: Nov 9, 2022 - Affected: through 4.2.1. ### [CVE-2022-37059](https://cve.now/CVE-2022-37059): Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field - Severity: Unrated - Published: Aug 29, 2022 - Affected: through 4.2.1. ### [CVE-2021-41502](https://cve.now/CVE-2021-41502): An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious… - Severity: Unrated - Published: Jun 11, 2022 - Affected: through 4.2.1. ### [CVE-2021-41948](https://cve.now/CVE-2021-41948): A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS \<= 4.2.1 version via "List of subjects". - Severity: Unrated - Published: Apr 29, 2022 - Affected: through 4.2.1. ### [CVE-2021-43464](https://cve.now/CVE-2021-43464): A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is… - Severity: Unrated - Published: Apr 4, 2022 - Affected: through 4.2.1. ### [CVE-2020-18325](https://cve.now/CVE-2020-18325): Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. - Severity: Unrated - Published: Mar 4, 2022 - Affected: through 4.2.1. ### [CVE-2020-18324](https://cve.now/CVE-2020-18324): Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. - Severity: Unrated - Published: Mar 4, 2022 - Affected: through 4.2.1. ### [CVE-2020-18326](https://cve.now/CVE-2020-18326): Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which… - Severity: Unrated - Published: Mar 4, 2022 - Affected: through 4.2.1. ### [CVE-2020-22330](https://cve.now/CVE-2020-22330): Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. - Severity: Unrated - Published: Aug 6, 2021 - Affected: from 4.2.1, fixed in 4.2.2. ### [CVE-2020-22392](https://cve.now/CVE-2020-22392): Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file. - Severity: Unrated - Published: Aug 5, 2021 - Affected: through 4.2.1. ### [CVE-2020-18155](https://cve.now/CVE-2020-18155): SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection. - Severity: Unrated - Published: Jul 14, 2021 - Affected: through 4.2.1. ### [CVE-2020-23761](https://cve.now/CVE-2020-23761): Cross Site Scripting (XSS) vulnerability in subrion CMS Version \<= 4.2.1 allows remote attackers to execute arbitrary web script via the… - Severity: Unrated - Published: Apr 9, 2021 - Affected: through 4.2.1. ### [CVE-2019-7357](https://cve.now/CVE-2019-7357): Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. - Severity: Unrated - Published: Nov 10, 2020 - Affected: through 4.2.1. ### [CVE-2019-20390](https://cve.now/CVE-2019-20390): A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the… - Severity: Unrated - Published: May 15, 2020 - Affected: versions 4.2.1. ### [CVE-2019-20389](https://cve.now/CVE-2019-20389): An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. - Severity: Unrated - Published: May 15, 2020 - Affected: through 4.2.1. ### [CVE-2020-12467](https://cve.now/CVE-2020-12467): Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie. - Severity: Unrated - Published: Apr 29, 2020 - Affected: through 4.2.1. ### [CVE-2020-12468](https://cve.now/CVE-2020-12468): Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. - Severity: Unrated - Published: Apr 29, 2020 - Affected: versions 4.2.1. ### [CVE-2020-12469](https://cve.now/CVE-2020-12469): admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the… - Severity: Unrated - Published: Apr 29, 2020 - Affected: through 4.2.1. ### [CVE-2018-21037](https://cve.now/CVE-2018-21037): Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI. - Severity: Unrated - Published: Mar 17, 2020 - Affected: fixed in 4.2.1. ### [CVE-2018-11317](https://cve.now/CVE-2018-11317): Subrion CMS before 4.1.4 has XSS. - Severity: Unrated - Published: Jul 3, 2019 - Affected: fixed in 4.1.4. ### [CVE-2017-18366](https://cve.now/CVE-2017-18366): Subrion CMS 4.1.5 has CSRF in blog/delete/. - Severity: Unrated - Published: Apr 12, 2019 - Affected: fixed in 4.2.1. ### [CVE-2018-16629](https://cve.now/CVE-2018-16629): panel/uploads/#elf\_l1\_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. - Severity: Unrated - Published: Dec 4, 2018 - Affected: through 4.2.1. ### [CVE-2018-19422](https://cve.now/CVE-2018-19422): /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess… - Severity: Unrated - Published: Nov 21, 2018 - Affected: fixed in 4.2.2. ### [CVE-2018-15563](https://cve.now/CVE-2018-15563): \_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles\[en\] parameter. - Severity: Unrated - Published: Oct 2, 2018 - Affected: through 4.2.1. ### [CVE-2018-16327](https://cve.now/CVE-2018-16327): There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration. - Severity: Unrated - Published: Sep 1, 2018 - Affected: versions 4.2.1. ### [CVE-2018-14840](https://cve.now/CVE-2018-14840): uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file… - Severity: Unrated - Published: Aug 2, 2018 - Affected: fixed in 4.2.2. ### [CVE-2018-14835](https://cve.now/CVE-2018-14835): Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas. - Severity: Unrated - Published: Aug 2, 2018 - Affected: through 4.2.1. ### [CVE-2017-15063](https://cve.now/CVE-2017-15063): There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. - Severity: Unrated - Published: Oct 6, 2017 - Affected: from 4.1, fixed in 4.2.0. ### [CVE-2017-10795](https://cve.now/CVE-2017-10795): Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body… - Severity: Unrated - Published: Jul 2, 2017 - Affected: fixed in 4.1.6. ### [CVE-2017-6068](https://cve.now/CVE-2017-6068): Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. - Severity: Unrated - Published: Mar 27, 2017 - Affected: through 4.0.5. ### [CVE-2017-5543](https://cve.now/CVE-2017-5543): includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted… - Severity: Unrated - Published: Jan 20, 2017 - Affected: from 4.0.5, fixed in 4.1.0. ### [CVE-2014-9120](https://cve.now/CVE-2014-9120): Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via… - Severity: Unrated - Published: Dec 10, 2014 - Affected: fixed in 3.2.3. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/intelliants/subrion Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.