siberiancms vulnerabilities

Products

• siberiancms 7
• SiberianCMS v5.0.8 1

Latest siberiancms CVEs

Newest publication first

1. CVE-2025-1105 SiberianCMS HTTP GET Request flat cross site scripting

   Published 2025-02-07

   Medium·CVSS 5.3 EPSS 0.39%

   A vulnerability was found in SiberianCMS 4.20.6. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /app/sae/design/desktop/flat of the component HTTP GET Request Handler. The manipulation leads to cross site scripting. The attack m...

2. CVE-2024-41702 SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

   Published 2024-07-30

   Critical·CVSS 9.8 EPSS 0.46%

   SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

3. CVE-2023-39378 SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') by an unauthenticated user

   Published 2023-09-26

   High·CVSS 8.8 EPSS 0.91%

   SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') by an unauthenticated user

4. CVE-2023-39377 SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method

   Published 2023-09-26

   High·CVSS 7.2 EPSS 1.0%

   SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method

5. CVE-2023-39376 SiberianCMS - CWE-284: Improper Access Control Authorized user may disable a security feature over the network

   Published 2023-09-26

   Medium·CVSS 6.5 EPSS 0.45%

   SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network

6. CVE-2023-39375 SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges

   Published 2023-09-26

   Critical·CVSS 9.8 EPSS 0.77%

   SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges

7. CVE-2017-6906 An issue was discovered in SiberianCMS before 4.10.0. The vulnerability exists due to insufficient filtration of user-supplied data (log) passed to the "SiberianCMS-master/errors/500.php" URL. An atta...

   Published 2017-03-15

   Medium·CVSS 6.1 EPSS 0.75%

   An issue was discovered in SiberianCMS before 4.10.0. The vulnerability exists due to insufficient filtration of user-supplied data (log) passed to the "SiberianCMS-master/errors/500.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.