instantsoft

6 results · Clear filters · Feed

• Low 3.5
  CVE-2026-108566

  InstantSoft icms2 Private Message index.tpl.php index cross site scripting

  A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads…

  instantsoft icms2
  Oct 11, 2026
• Low 3.1
  CVE-2026-48707

  InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning

  InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature…

  instantsoft icms2
  Sep 8, 2026
• Low 3.5
  CVE-2024-31213

  InstantCMS Open Redirect vulnerability

  InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web applicati…

  instantsoft icms2
  Apr 5, 2024
• Low 3.5
  CVE-2023-4879

  Cross-site Scripting (XSS) - Stored in instantsoft/icms2

  Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.

  instantsoft instantsoft/icms2
  Sep 10, 2023
• Low 2.6
  CVE-2023-4654

  Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2

  Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

  instantsoft instantsoft/icms2
  Aug 31, 2023
• Low 3.5
  CVE-2023-4187

  Cross-site Scripting (XSS) - Stored in instantsoft/icms2

  Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

  instantsoft instantsoft/icms2
  Aug 5, 2023