instantsoft vulnerabilities

Products

• instantsoft/icms2 15
• icms2 10
• instantcms 5

Latest instantsoft CVEs

Newest publication first · page 1 of 2

1. CVE-2026-108568 InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity

   Published 2026-10-11

   Medium·CVSS 5.3 EPSS 0.13%

   A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insuf...

2. CVE-2026-108567 InstantSoft icms2 Image image.php files_delete_file path traversal

   Published 2026-10-11

   Medium·CVSS 5.3 EPSS 0.37%

   A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remote...

3. CVE-2026-108566 InstantSoft icms2 Private Message index.tpl.php index cross site scripting

   Published 2026-10-11

   Medium·CVSS 5.1 EPSS 0.24%

   A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site script...

4. CVE-2026-48707 InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning

   Published 2026-09-08

   Low·CVSS 3.1 EPSS 0.27%

   InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (system/core/uploader.php at lines 509-532). When the "upload from URL" feature follows an HTTP redire...

5. CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

   Published 2026-09-08

   Medium·CVSS 5.5 EPSS 0.66%

   InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into th...

6. CVE-2026-28281 InstantCMS has Multiple CSRF Vulnerabilities

   Published 2026-03-09

   High·CVSS 7.1 EPSS 0.15%

   InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. T...

7. CVE-2025-59055 InstantCMS vulnerable to Server-Side Request Forgery via package installer

   Published 2025-09-11

   High·CVSS 7.2 EPSS 0.45%

   InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It is possible to make...

8. CVE-2024-50348 InstantCMS has a Cross Site Scripting Vulnerability

   Published 2024-10-29

   Medium·CVSS 5.4 EPSS 0.35%

   InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in...

9. CVE-2024-31213 InstantCMS Open Redirect vulnerability

   Published 2024-04-05

   Medium·CVSS 5.4 EPSS 0.40%

   InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are...

10. CVE-2024-31212 SQL injection in index_chart_data action

    Published 2024-04-04

    High·CVSS 7.2 EPSS 0.85%

    InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in index_chart_data ac...

11. CVE-2023-4928 SQL Injection in instantsoft/icms2

    Published 2023-09-13

    High·CVSS 7.2 EPSS 0.90%

    SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.

12. CVE-2023-4879 Cross-site Scripting (XSS) - Stored in instantsoft/icms2

    Published 2023-09-10

    Medium·CVSS 4.8 EPSS 0.40%

    Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.

13. CVE-2023-4878 Server-Side Request Forgery (SSRF) in instantsoft/icms2

    Published 2023-09-10

    Medium·CVSS 5.4 EPSS 0.38%

    Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

14. CVE-2023-4704 External Control of System or Configuration Setting in instantsoft/icms2

    Published 2023-09-01

    Medium·CVSS 4.9 EPSS 0.89%

    External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

15. CVE-2023-4654 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2

    Published 2023-08-31

    Low·CVSS 3.5 EPSS 0.34%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

16. CVE-2023-4655 Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

    Published 2023-08-31

    Medium·CVSS 6.1 EPSS 0.47%

    Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.

17. CVE-2023-4652 Cross-site Scripting (XSS) - Stored in instantsoft/icms2

    Published 2023-08-31

    Medium·CVSS 5.4 EPSS 0.51%

    Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

18. CVE-2023-4653 Cross-site Scripting (XSS) - Stored in instantsoft/icms2

    Published 2023-08-31

    Medium·CVSS 4.8 EPSS 0.49%

    Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

19. CVE-2023-4650 Improper Access Control in instantsoft/icms2

    Published 2023-08-31

    Medium·CVSS 4.7 EPSS 0.54%

    Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

20. CVE-2023-4649 Session Fixation in instantsoft/icms2

    Published 2023-08-31

    Medium·CVSS 5.4 EPSS 0.44%

    Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.

21. CVE-2023-4651 Server-Side Request Forgery (SSRF) in instantsoft/icms2

    Published 2023-08-31

    Medium·CVSS 5.4 EPSS 0.42%

    Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.

22. CVE-2023-4381 Unverified Password Change in instantsoft/icms2

    Published 2023-08-16

    Medium·CVSS 4.3 EPSS 0.43%

    Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

23. CVE-2023-4189 Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

    Published 2023-08-05

    Medium·CVSS 4.8 EPSS 0.47%

    Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

24. CVE-2023-4188 SQL Injection in instantsoft/icms2

    Published 2023-08-05

    Critical·CVSS 9.1 EPSS 0.93%

    SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

25. CVE-2023-4187 Cross-site Scripting (XSS) - Stored in instantsoft/icms2

    Published 2023-08-05

    Medium·CVSS 4.8 EPSS 0.47%

    Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.