Skip to content
OpenAdvisories

Package · Packagist

impresscms/impresscms

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 4.8
    CVE-2023-37785

    ImpressCMS Cross-site Scripting vulnerability

    A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the component /editprofile.php.

    impresscms/impresscms Packagist
  • Medium 5.3
    CVE-2021-26598 Scanner template EPSS 11%

    Incorrect Access Control in ImpressCMS

    ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).

    impresscms/impresscms Packagist
  • Medium —
    CVE-2021-28088

    Cross-site scripting (XSS)

    Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML parameters through the "Display Name" field.

    impresscms/impresscms Packagist
  • Medium 4.8
    CVE-2020-17551

    Cross-site scripting (XSS)

    ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.

    impresscms/impresscms Packagist
  • Medium 6.1
    CVE-2018-13983

    ImpressCMS XSS

    ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck.php.

    impresscms/impresscms Packagist
  • Medium —
    CVE-2014-1836 Public exploit

    ImpressCMS Path Traversal to Arbitrary File Delete

    Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.

    impresscms/impresscms Packagist
  • Medium —
    CVE-2014-4036

    ImpressCMS Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action.

    impresscms/impresscms Packagist
  • Medium —
    CVE-2010-4616

    ImpressCMS Cross-site Scripting vulnerability via quicksearch_ContentContent parameter

    Cross-site scripting (XSS) vulnerability in modules/content/admin/content.php in ImpressCMS 1.2.3 Final, and possibly other versions before 1.2.4, allows remote attackers to inject arbitrary web script or HTML via the quicksearch_ContentContent parameter.

    impresscms/impresscms Packagist