Advisories · Technology
InstantSoft icms2.
Every CVE that names InstantSoft icms2 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity
- InstantSoft icms2
- CWE-345
- CVSS 5.3 Medium
InstantSoft icms2 Image image.php files_delete_file path traversal
- InstantSoft icms2
- Path traversal
- CVSS 5.1 Medium
InstantSoft icms2 Private Message index.tpl.php index cross site scripting
- InstantSoft icms2
- Cross-site scripting (XSS)
- Code injection
- CVSS 3.1 Low
InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
- instantsoft icms2
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
InstantCMS has Remote Code Execution in package installer
- instantsoft icms2
- Code injection
- Unrestricted file upload
- CVSS 7.1 High
InstantCMS has Multiple CSRF Vulnerabilities
- instantsoft icms2
- Cross-site request forgery (CSRF)
- CVSS 4.7 Medium
InstantCMS vulnerable to Server-Side Request Forgery via package installer
- instantsoft icms2
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
InstantCMS has a Cross Site Scripting Vulnerability
- instantsoft icms2
- Cross-site scripting (XSS)
- CVSS 3.5 Low
InstantCMS Open Redirect vulnerability
- instantsoft icms2
- Open redirect
- CVSS 6.7 Medium
SQL injection in index_chart_data action
- instantsoft icms2
- SQL injection
- CWE-20
- CVSS 7.2 High
SQL Injection in instantsoft/icms2
- instantsoft/icms2
- SQL injection
- CVSS 3.5 Low
Cross-site Scripting (XSS) - Stored in instantsoft/icms2
- instantsoft/icms2
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Server-Side Request Forgery (SSRF) in instantsoft/icms2
- instantsoft/icms2
- Server-side request forgery (SSRF)
- CVSS 8.8 High
External Control of System or Configuration Setting in instantsoft/icms2
- instantsoft/icms2
- CWE-15
- CVSS 2.6 Low
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2
- instantsoft/icms2
- CWE-614
- CVSS 4.3 Medium
Cross-site Scripting (XSS) - Reflected in instantsoft/icms2
- instantsoft/icms2
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Improper Access Control in instantsoft/icms2
- instantsoft/icms2
- Broken access control
- CVSS 4.3 Medium
Session Fixation in instantsoft/icms2
- instantsoft/icms2
- Authentication bypass
- CVSS 6.4 Medium
Server-Side Request Forgery (SSRF) in instantsoft/icms2
- instantsoft/icms2
- Server-side request forgery (SSRF)
- CVSS 5.9 Medium
Cross-site Scripting (XSS) - Stored in instantsoft/icms2
- instantsoft/icms2
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Cross-site Scripting (XSS) - Stored in instantsoft/icms2
- instantsoft/icms2
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Unverified Password Change in instantsoft/icms2
- instantsoft/icms2
- CWE-620
- CVSS 4.8 Medium
Cross-site Scripting (XSS) - Reflected in instantsoft/icms2
- instantsoft/icms2
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL Injection in instantsoft/icms2
- instantsoft/icms2
- SQL injection
- CVSS 3.5 Low
Cross-site Scripting (XSS) - Stored in instantsoft/icms2
- instantsoft/icms2
- Cross-site scripting (XSS)