Ametys

ametys

Vendor: Ametys • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-50937 1Ametys 1Ametys Jun 17, 2026 Jan 13, 2026 5.1 MEDIUM· v4 6.1 MEDIUM· v3 N/A· v2 Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for external links. Attackers can inject malicious script code in link text and descriptions to execute pers...Show more Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for external links. Attackers can inject malicious script code in link text and descriptions to execute persistent attacks that compromise user sessions and manipulate application modules.Show less
CVE-2024-30614 1Ametys 1Ametys Jun 17, 2026 Apr 12, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope.
CVE-2022-26159 1Ametys 1Ametys Jun 17, 2026 Feb 28, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languag...Show more The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.Show less
CVE-2017-16935 1Ametys 1Ametys May 13, 2026 Nov 24, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xm...Show more Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account details via a users/search.json request, and then modifying the account via an editUser request.Show less