Evolution cms

This hub aggregates every CVE we track for Evolution cms, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 8 most recently published vulnerabilities affecting Evolution cms.

• CVE-2021-47939Evolution CMS 3.1.6 Authenticated Remote Code Execution via Module Creation8.8May 10, 2026
• CVE-2023-43340Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmsp...5.2Oct 19, 2023
• CVE-2023-43341Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.6.1Oct 19, 2023
• BDU:2022-00851Уязвимость системы управления контентом Evolution CMS, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю осуществлять межсайтовые сценарные атаки (XSS)8.4Feb 18, 2022
• CVE-2020-23238Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature.5.4Jul 26, 2021
• CVE-2019-14518Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the "access policy in the administration panel.5.4Aug 15, 2019
• CVE-2018-16638Evolution CMS 1.4.x allows XSS via the manager/ search parameter.5.4Dec 28, 2018
• CVE-2018-16637Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.5.4Dec 28, 2018