Skip to content

Vendor

cmseasy vulnerabilities

23 published CVES affecting cmseasy, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
23
Critical
2
High
5
Medium
15
Low
1
Unscored
0
CISA KEV
0
Atom feed of cmseasy alerts

Products

Latest cmseasy CVEs

Newest publication first

  2. CVE-2025-11332 CmsEasy URL view.php cross site scripting

    Published
    MediumCVSS 5.1 EPSS 0.30%

    A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php of the component URL Handler. Executing a manipulation of the argument PHP_SELF can lead to cross site scripting. The attack may be launched remotely. The explo...

  4. CVE-2025-1336 CmsEasy image_admin.php deleteimg_action path traversal

    Published
    MediumCVSS 5.3 EPSS 1.0%

    A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimg_action in the library lib/admin/image_admin.php. The manipulation of the argument imgname leads to path traversal. The attack can be launched...

  5. CVE-2025-1335 CmsEasy file_admin.php deleteimg_action path traversal

    Published
    MediumCVSS 5.3 EPSS 0.94%

    A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimg_action in the library lib/admin/file_admin.php. The manipulation of the argument imgname leads to path traversal. It is possible to launch the attack remotely. T...

  6. CVE-2025-1106 CmsEasy database_admin.php restore_action path traversal

    Published
    MediumCVSS 5.3 EPSS 0.98%

    A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/database_admin.php. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit h...

  7. CVE-2025-0973 CmsEasy index.php backAll_action path traversal

    Published
    MediumCVSS 5.3 EPSS 0.91%

    A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_admin.php of the file /index.php?case=database&act=backAll&admin_dir=admin&site=default. The manipulation of the argument...

  8. CVE-2024-34314 CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template_admin.php. This vulnerability allows att...

    Published
    MediumCVSS 4.9 EPSS 0.45%

    CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files.

  9. CVE-2024-34315 CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/template_admin.php. This vulnerability allows a...

    Published
    HighCVSS 7.5 EPSS 0.67%

    CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files.

  15. CVE-2024-0523 CmsEasy language_admin.php getslide_child_action sql injection

    Published
    CriticalCVSS 9.8 EPSS 0.71%

    A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslide_child_action in the library lib/admin/language_admin.php. The manipulation of the argument sid leads to sql injection. The attack can be lau...

  17. CVE-2023-34880 cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php. This vulnerability allows attackers to execute arbitrary c...

    Published
    CriticalCVSS 9.8 EPSS 1.1%

    cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php. This vulnerability allows attackers to execute arbitrary code and perform a local file inclusion.

  18. CVE-2021-42644 cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_dat...

    Published
    MediumCVSS 6.5 EPSS 0.98%

    cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.