Skip to content
OpenAdvisories

Vendor

instantsoft

25 known vulnerabilities.

Products

instantsoft/icms2 15 icms2 10
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-108568

    InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity

    A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/…

    instantsoft icms2
  • Medium 4.3
    CVE-2026-108567

    InstantSoft icms2 Image image.php files_delete_file path traversal

    A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack ma…

    instantsoft icms2
  • Medium 5.5
    CVE-2026-54611

    InstantCMS has Remote Code Execution in package installer

    InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malici…

    instantsoft icms2
  • Medium 4.7
    CVE-2025-59055

    InstantCMS vulnerable to Server-Side Request Forgery via package installer

    InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. I…

    instantsoft icms2
  • Medium 5.4
    CVE-2024-50348

    InstantCMS has a Cross Site Scripting Vulnerability

    InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulne…

    instantsoft icms2
  • Medium 6.7
    CVE-2024-31212

    SQL injection in index_chart_data action

    InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists i…

    instantsoft icms2
  • Medium 4.3
    CVE-2023-4878

    Server-Side Request Forgery (SSRF) in instantsoft/icms2

    Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Medium 4.3
    CVE-2023-4655

    Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

    Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.

    instantsoft instantsoft/icms2
  • Medium 6.4
    CVE-2023-4651

    Server-Side Request Forgery (SSRF) in instantsoft/icms2

    Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.

    instantsoft instantsoft/icms2
  • Medium 4.7
    CVE-2023-4650

    Improper Access Control in instantsoft/icms2

    Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Medium 6.8
    CVE-2023-4652

    Cross-site Scripting (XSS) - Stored in instantsoft/icms2

    Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Medium 4.3
    CVE-2023-4649

    Session Fixation in instantsoft/icms2

    Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.

    instantsoft instantsoft/icms2
  • Medium 5.9
    CVE-2023-4653

    Cross-site Scripting (XSS) - Stored in instantsoft/icms2

    Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Medium 4.3
    CVE-2023-4381

    Unverified Password Change in instantsoft/icms2

    Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Medium 4.8
    CVE-2023-4189

    Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

    Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2