MediumCVSS 6.1
ExpressionEngine before 4.3.5 has reflected XSS.
Vendor
expressionengine vulnerabilities
7 published CVES affecting expressionengine, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 7
- Critical
- 0
- High
- 1
- Medium
- 6
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest expressionengine CVEs
Newest publication first
-
-
MediumCVSS 5.4
EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection
-
HighCVSS 7.5
ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.
-
MediumCVSS 6.5
Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module t...
-
MediumCVSS 4.3 EPSS 1.7%
Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the avatar parameter.
-
MediumCVSS 4.3
CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter.
-
MediumCVSS 4.3
Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameter.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.