phpcms

Top products

The 15 most recently published vulnerabilities affecting phpcms.

• CVE-2025-25958Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script.5.4Feb 20, 2025
• CVE-2025-25960Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator.6.1Feb 20, 2025
• CVE-2021-40910There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.6.1Jun 15, 2022
• CVE-2020-22203SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php.9.8Jun 16, 2021
• CVE-2020-22201phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php.8.8Jun 16, 2021
• CVE-2020-22200Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword.5.3Jun 16, 2021
• CVE-2020-22199SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php.9.8Jun 16, 2021
• CVE-2019-10027PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.4.8Mar 24, 2019
• CVE-2018-19127A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The...9.8Nov 9, 2018
• CVE-2018-14940PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkcode request.7.5Aug 5, 2018
• CVE-2013-5939Multiple cross-site scripting (XSS) vulnerabilities in the Guestbook module for PHPCMS allow remote attackers to inject arbitrary web script or HTML via the (1) list or (2) introduce parameter to i...4.3May 14, 2014
• CVE-2011-0645SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the where_time parameter in a get action.7.5Jan 25, 2011
• CVE-2011-0644SQL injection vulnerability in include/admin/model_field.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the modelid parameter to flash_upload.php.7.5Jan 25, 2011
• CVE-2008-0513Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to parser/parser....7.8Jan 31, 2008
• CVE-2006-3019Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in parser/include/ ...7.5Jun 15, 2006