Intelliants
Intelliants Subrion CMS: vulnerabilidades y CVE
Intelliants Subrion CMS tiene 40 vulnerabilidades publicadas, 5 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE40
Últimos 12 meses5
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-96773 | Baja (2.1) | 0.25% | — | 23 sept 2026 | A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the… |
| CVE-2026-96772 | Media (5.5) | 0.29% | — | 23 sept 2026 | A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information… |
| CVE-2026-72604 | Media (6.5) | 0.52% | — | 11 ago 2026 | A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a… |
| CVE-2026-12202 | Baja (1.9) | 0.21% | — | 15 jun 2026 | A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. Such manipulation of the argument CSS class name leads to… |
| CVE-2025-70958 | Media (6.1) | 0.29% | — | 2 feb 2026 | Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a… |
| CVE-2025-56556 | Baja (3.8) | 0.20% | — | 11 sept 2025 | An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel - to gain escalated privileges in the… |
| CVE-2024-25399 | Media (6.1) | 0.35% | — | 27 feb 2024 | Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. |
| CVE-2023-43875 | Media (6.1) | 0.76% | — | 19 oct 2023 | Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser,… |
| CVE-2022-43121 | Media (6.1) | 0.61% | — | 9 nov 2022 | A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tooltip text field. |
| CVE-2022-43120 | Media (6.1) | 0.52% | — | 9 nov 2022 | A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field… |
| CVE-2022-37059 | Media (4.8) | 0.56% | — | 29 ago 2022 | Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field |
| CVE-2021-41502 | Media (5.4) | 0.55% | — | 11 jun 2022 | An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or… |
| CVE-2021-43464 | Alta (8.8) | 1.4% | — | 4 abr 2022 | A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval(). |
| CVE-2020-18326 | Alta (8.8) | 2.2% | — | 4 mar 2022 | Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to… |
| CVE-2020-18325 | Media (6.1) | 1.6% | — | 4 mar 2022 | Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. |
| CVE-2020-18324 | Media (6.1) | 2.2% | — | 4 mar 2022 | Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. |
| CVE-2021-43724 | Media (4.8) | 0.49% | — | 24 feb 2022 | A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file. |
| CVE-2021-41947 | Alta (7.2) | 1.2% | — | 8 oct 2021 | A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode. |
| CVE-2020-22392 | Media (5.4) | 0.62% | — | 5 ago 2021 | Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file. |
| CVE-2020-35437 | Media (6.1) | 3.1% | — | 26 dic 2020 | Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the /_core/profile/ URI. |
| CVE-2019-7357 | Alta (8.8) | 1.4% | — | 10 nov 2020 | Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins. |
| CVE-2019-11406 | Media (6.1) | 0.95% | — | 8 may 2019 | Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter. |
| CVE-2017-18366 | Alta (8.8) | 0.65% | — | 15 abr 2019 | Subrion CMS 4.1.5 has CSRF in blog/delete/. |
| CVE-2018-16631 | Media (5.4) | 0.56% | — | 4 dic 2018 | Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter. |
| CVE-2018-16629 | Media (4.8) | 0.56% | — | 4 dic 2018 | panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. |
| CVE-2018-19422 | Alta (7.2) | 64% | — | 21 nov 2018 | /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. |
| CVE-2017-11445 | Crítica (9.8) | 1.1% | — | 19 jul 2017 | Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array. |
| CVE-2017-11444 | Crítica (9.8) | 13% | — | 19 jul 2017 | Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array. |
| CVE-2017-6069 | Alta (8.8) | 0.72% | — | 27 mar 2017 | Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter. |
| CVE-2017-6068 | Alta (8.8) | 0.61% | — | 27 mar 2017 | Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.