CVE Tools
Track your stack

Impresscms

23 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Impresscms, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Impresscms CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Impresscms CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-011
2026-020
2026-030
2026-041
2026-051
2026-060
2026-070
2026-081
2026-090
2026-100

Severity

How the 23 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical522%
  • High626%
  • Medium1252%

Latest CVEs

The 15 most recently published vulnerabilities affecting Impresscms.

  1. CVE-2026-73679ImpressCMS Authenticated RCE via PHP Custom Tag eval()7.2
  2. CVE-2021-47938ImpressCMS 1.4.2 Remote Code Execution via Autotasks8.8
  3. CVE-2019-25703ImpressCMS 1.3.11 SQL Injection via bid Parameter7.1
  4. CVE-2022-50912ImpressCMS 1.4.4 - Unrestricted File Upload9.8
  5. CVE-2023-37785A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of ...4.8
  6. CVE-2022-26986SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the databa...7.2
  7. CVE-2021-26601ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.8.1
  8. CVE-2021-26600ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).9.8
  9. CVE-2021-26599ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.9.8
  10. CVE-2021-26598ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).5.3
  11. CVE-2022-24977ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php scri...9.8
  12. CVE-2021-28088Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML parameters through the "Display Name" field.5.4
  13. CVE-2020-17551ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.4.8
  14. CVE-2018-13983ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck.php.6.1
  15. CVE-2014-1836Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_p...6.4

Product grouping is registry-driven, with AI assist and human review. How it works