ametys vulnerabilities

Products

• ametys 4
• Ametys CMS 1

Latest ametys CVEs

Newest publication first

1. CVE-2022-50937 Ametys CMS v4.4.1 - Cross Site Scripting (XSS)

   Published 2026-01-13

   Medium·CVSS 5.1 EPSS 0.32%

   Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for external links. Attackers can inject malicious script code in link text and descriptions to execute persistent attacks that compromise user sessions and manipulate...

2. CVE-2024-30614 An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope.

   Published 2024-04-12

   Medium·CVSS 5.3 EPSS 0.48%

   An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope.

3. CVE-2022-26159 The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnam...

   Published 2022-02-28

   Medium·CVSS 5.3 EPSS 13.4%

   The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters typed by all users, includ...

4. CVE-2017-16935 Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/se...

   Published 2017-11-24

   Critical·CVSS 9.8 EPSS 7.7%

   Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaini...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.