Intelliants Subrion vulnerabilities

CVE-2020-18324 [MEDIUM] CWE-79 Cross-site Scripting in Subrion CMS Cross-site Scripting in Subrion CMS Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the `q` parameter in the Kickstart template.

CVE-2020-18325 [MEDIUM] CWE-79 Cross-site Scripting in intelliants/subrion Cross-site Scripting in intelliants/subrion Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.

CVE-2018-15563 [MEDIUM] CWE-79 CVE-2018-15563: _core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter. _core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.

CVE-2019-7356 [MEDIUM] CWE-79 CVE-2019-7356: Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter. Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.

CVE-2023-43828 [MEDIUM] CWE-79 CVE-2023-43828: A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter.

CVE-2021-41948 [MEDIUM] CWE-79 CVE-2021-41948: A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2. A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".

CVE-2023-43884 [MEDIUM] CWE-79 CVE-2023-43884: A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' parameter.

CVE-2025-70958 [MEDIUM] CWE-79 Subrion CMS vulnerable to cross-site scripting Subrion CMS vulnerable to cross-site scripting Multiple reflected Cross-site Scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allow attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters.

CVE-2020-22330 [MEDIUM] CWE-79 CVE-2020-22330: Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.

CVE-2023-43830 [MEDIUM] CWE-79 CVE-2023-43830: A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allo A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum deposit', 'Maximum deposit' and/or 'Maximum balance'.

CVE-2021-41502 [MEDIUM] CWE-79 Cross site scripting in intelliants/subrion Cross site scripting in intelliants/subrion An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or adding the onerror attribute.

CVE-2023-43875 [MEDIUM] CWE-79 Subrion CMS vulnerable to Cross-site Scripting Subrion CMS vulnerable to Cross-site Scripting Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail.

CVE-2018-14835 [MEDIUM] CWE-79 Subrion CMS XSS Subrion CMS XSS Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.

CVE-2020-22392 [MEDIUM] CWE-79 Cross Site Scripting in Subrion CMS Cross Site Scripting in Subrion CMS Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.

CVE-2018-16327 [MEDIUM] CWE-79 CVE-2018-16327: There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration. There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.

CVE-2022-43120 [MEDIUM] CWE-79 Subrion CMS is vulnerable to Cross-Site Scripting (XSS) Subrion CMS is vulnerable to Cross-Site Scripting (XSS) A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS version 4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field default value text field.

CVE-2024-25399 [MEDIUM] CWE-79 Subrion CMS vulnerable to Cross Site Scripting Subrion CMS vulnerable to Cross Site Scripting Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.

CVE-2022-43121 [MEDIUM] CWE-79 Subrion CMS is vulnerable to Cross-Site Scripting (XSS) Subrion CMS is vulnerable to Cross-Site Scripting (XSS) A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS in version 4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tooltip text field.

CVE-2014-9120 [MEDIUM] CWE-79 CVE-2014-9120: Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inje Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to subrion/search/.

CVE-2018-16629 [MEDIUM] CWE-79 Subrion CMS XSS Subrion CMS XSS `panel/uploads/#elf_l1_XA` in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.