siteserver/cms vulnerabilities

Latest siteserver/cms CVEs

Newest publication first

1. CVE-2026-111658 SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API

   Published 2026-10-16

   Medium·CVSS 5.1 EPSS 0.33%

   SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite anoth...

2. CVE-2023-2862 SiteServer CMS search cross site scripting

   Published 2023-05-24

   Medium·CVSS 6.1 EPSS 0.56%

   A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file /api/stl/actions/search. The manipulation of the argument ajaxDivId leads to cross site scripting. It is possible to launch the attack remote...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.