Search for packages
| purl | pkg:composer/intelliants/subrion@4.2.1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-qpxw-6473-ppww
Aliases: CVE-2020-12467 |
Session Fixation in Subrion CMS Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie. | There are no reported fixed by versions. |
|
GHSA-7q44-gfvq-6g93
Aliases: CVE-2020-18155 |
SQL Injection in Subrion CMS SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses … | There are no reported fixed by versions. |
|
GHSA-hxj6-v58r-cqv3
Aliases: CVE-2020-22392 |
Cross Site Scripting in Subrion CMS Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog … | There are no reported fixed by versions. |
|
GHSA-h8wv-vv58-468h
Aliases: CVE-2025-56556 |
Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool An issue was discovered in … | There are no reported fixed by versions. |
|
GHSA-3wmg-28v9-8hf6
Aliases: CVE-2022-43120 |
Subrion CMS is vulnerable to Cross-Site Scripting (XSS) A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion … | There are no reported fixed by versions. |
|
GHSA-jrvr-gmqv-hgrh
Aliases: CVE-2022-43121 |
Subrion CMS is vulnerable to Cross-Site Scripting (XSS) A cross-site scripting (XSS) vulnerability in the CMS Field Add page of … | There are no reported fixed by versions. |
|
GHSA-jv64-2m3x-6v4q
Aliases: CVE-2021-41948 |
Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin A cross-site scripting (XSS) vulnerability exists in the `contact … | There are no reported fixed by versions. |
|
GHSA-g54x-29xv-58h5
Aliases: CVE-2021-43464 |
Remote code execution in Subrion Subrion is an open source php content management system. A Remiote Code Execution (RCE) vulnerability … | There are no reported fixed by versions. |
|
GHSA-jvq4-cgfw-jgf4
Aliases: CVE-2021-41502 |
Cross site scripting in intelliants/subrion An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) … | There are no reported fixed by versions. |
|
GHSA-fmqq-hw9m-448q
Aliases: CVE-2020-12469 |
Subrion CMS PHP Object Injection admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via … | There are no reported fixed by versions. |
|
GHSA-jj94-j4r3-5gr4
Aliases: CVE-2020-22330 |
Subrion Cross-Site Scripting (XSS) vulnerability Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. | There are no reported fixed by versions. |
|
GHSA-4f4h-jgjp-3vfg
Aliases: CVE-2020-12468 |
Subrion CMS CSV injection via Export Language Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. … | There are no reported fixed by versions. |
|
GHSA-xhc3-5pgf-p576
Aliases: CVE-2020-23761 |
subrion CMS Cross Site Scripting (XSS) vulnerability Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote … | There are no reported fixed by versions. |
|
GHSA-73xj-v6gc-g5p5
Aliases: CVE-2018-19422 |
Subrion CMS RCE Vulnerability `/panel/uploads` in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht … | There are no reported fixed by versions. |
|
GHSA-xvgx-668j-f67p
Aliases: CVE-2019-20389 |
Subrion CMS XSS An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can … | There are no reported fixed by versions. |
|
GHSA-5mh2-82g9-72jv
Aliases: CVE-2019-7357 |
Subrion CMS CSRF Vulnerability Subrion CMS 4.2.1 has CSRF in `panel/modules/plugins/`. The attacker can remotely activate/deactivate the plugins. | There are no reported fixed by versions. |
|
GHSA-c4wx-3x5q-hf4w
Aliases: CVE-2019-20390 |
Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that … | There are no reported fixed by versions. |
|
GHSA-rh4r-9689-6xw4
Aliases: CVE-2022-37059 |
Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel Cross Site Scripting (XSS) in the Admin Panel of Subrion … | There are no reported fixed by versions. |
|
GHSA-9cc3-5w85-pxvx
Aliases: CVE-2020-18326 |
Cross Site Request Forgery in intelliants/subrion Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the … | There are no reported fixed by versions. |
|
GHSA-pcwq-7wrw-r8jv
Aliases: CVE-2020-18325 |
Cross-site Scripting in intelliants/subrion Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. | There are no reported fixed by versions. |
|
GHSA-xj7h-g7rh-gjcw
Aliases: CVE-2020-18324 |
Cross-site Scripting in Subrion CMS Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the `q` parameter in … | There are no reported fixed by versions. |
|
GHSA-xxf8-fpmr-fw7v
Aliases: CVE-2024-25400 |
Withdrawn Advisory: Subrion CMS vulnerable to SQL Injection ## Withdrawn Advisory This advisory has been withdrawn because it was determined … | There are no reported fixed by versions. |
|
GHSA-q4qh-8pxw-r48q
Aliases: CVE-2024-25399 |
Subrion CMS vulnerable to Cross Site Scripting Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. | There are no reported fixed by versions. |
|
GHSA-2x28-c7j7-23gv
Aliases: CVE-2023-46947 |
Subrion remote command execution vulnerability Subrion 4.2.1 has a remote command execution vulnerability in the backend. | There are no reported fixed by versions. |
|
GHSA-646r-8fcc-p82r
Aliases: CVE-2023-43875 |
Subrion CMS vulnerable to Cross-site Scripting Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local … | There are no reported fixed by versions. |
|
GHSA-q832-2275-rfqh
Aliases: CVE-2023-43830 |
Subrion CMS XSS in /panel/configuration/financial/ A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary … | There are no reported fixed by versions. |
|
GHSA-4w2j-wj9q-6wpx
Aliases: CVE-2023-43828 |
Subrion CMS Cross-site Scripting vulnerability in /panel/languages A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to … | There are no reported fixed by versions. |
|
GHSA-7vff-rv2f-cj79
Aliases: CVE-2023-43884 |
Subrion CMS Cross-site Scripting vulnerability A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 … | There are no reported fixed by versions. |
|
GHSA-9jjm-mc56-3qxv
Aliases: CVE-2025-70958 |
Subrion CMS vulnerable to cross-site scripting Multiple reflected Cross-site Scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 … | There are no reported fixed by versions. |
|
CVE-2020-12467
|
Session Fixation Subrion CMS allows session fixation via an alphanumeric value in a session cookie. | There are no reported fixed by versions. |
|
CVE-2018-14840
|
Cross-site Scripting `uploads/.htaccess` in Subrion CMS allows XSS because it does not block `.html` file uploads. | There are no reported fixed by versions. |
|
CVE-2023-43830
Aliases: GHSA-q832-2275-rfqh |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 … | There are no reported fixed by versions. |
|
CVE-2023-46947
Aliases: GHSA-2x28-c7j7-23gv |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Subrion 4.2.1 has a remote command execution … | There are no reported fixed by versions. |
|
CVE-2018-15563
|
Cross-site Scripting `_core/admin/pages/add/` in Subrion CMS has XSS via the `titles[en]` parameter. | There are no reported fixed by versions. |
|
CVE-2020-22330
|
Cross-site Scripting Cross-Site Scripting (XSS) vulnerability in Subrion via the title when adding a page. | There are no reported fixed by versions. |
|
CVE-2020-18155
|
SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection. | There are no reported fixed by versions. |
|
CVE-2023-43828
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 … | There are no reported fixed by versions. |
|
CVE-2019-20389
|
Cross-site Scripting An XSS issue was identified on the Subrion CMS `/panel/configuration/general` settings page. A remote attacker can inject arbitrary … | There are no reported fixed by versions. |
|
CVE-2023-43884
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A Cross-site scripting (XSS) vulnerability in Reference ID from the … | There are no reported fixed by versions. |
|
GHSA-9738-c49q-4rgc
Aliases: CVE-2018-16327 |
Subrion Cross-site Scripting (XSS) There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration. | There are no reported fixed by versions. |
|
GHSA-c8mg-wp7h-f2pf
Aliases: CVE-2018-14835 |
Subrion CMS XSS Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information … | There are no reported fixed by versions. |
|
GHSA-vhqr-3gr2-7px9
Aliases: CVE-2018-14840 |
Subrion CMS Cross-site Scripting `uploads/.htaccess` in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but … | There are no reported fixed by versions. |
|
GHSA-mxv3-qcmf-r6wj
Aliases: CVE-2018-16629 |
Subrion CMS XSS `panel/uploads/#elf_l1_XA` in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. | There are no reported fixed by versions. |
|
GHSA-6wc4-v4v5-3m82
Aliases: CVE-2018-15563 |
Subrion CMS Stored Cross-site Scripting (XSS) `_core/admin/pages/add/` in Subrion CMS 4.2.1 has XSS via the titles[en] parameter. | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-g8j7-w673-4mjp
|
Subrion CMS CSRF Vulnerability Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the … |
CVE-2018-21037
|
|
GHSA-c939-g732-48r8
|
Subrion CMS vulnerable to CSRF in blog/delete Subrion CMS is vulnerable to cross-site request forgery in `blog/delete/`. This has been … |
CVE-2017-18366
|