instantsoft instantcms vulnerabilities

Latest instantsoft instantcms CVEs

Newest publication first

1. CVE-2024-31213 InstantCMS Open Redirect vulnerability

   Published 2024-04-05

   Medium·CVSS 5.4 EPSS 0.40%

   InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are...

2. CVE-2023-4189 Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

   Published 2023-08-05

   Medium·CVSS 4.8 EPSS 0.47%

   Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

3. CVE-2023-4188 SQL Injection in instantsoft/icms2

   Published 2023-08-05

   Critical·CVSS 9.1 EPSS 0.93%

   SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

4. CVE-2023-4187 Cross-site Scripting (XSS) - Stored in instantsoft/icms2

   Published 2023-08-05

   Medium·CVSS 4.8 EPSS 0.47%

   Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

5. CVE-2013-6839 SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to catalog/[id].

   Published 2013-12-13

   High·CVSS 7.5 EPSS 1.2%

   SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to catalog/[id].

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.