← Back

Subrion

subrion

Vendor: Intelliants • 25 CVEs

CVEs (25)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-14840
1Intelliants
1Subrion
Nov 21, 2024
Aug 2, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
CVE-2017-15063
1Intelliants
1Subrion
May 13, 2026
Oct 6, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing (for...Show more
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing (for example) an attack against the query parameter to panel/database.Show less
CVE-2017-10795
1Intelliants
1Subrion
May 13, 2026
Jul 2, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.
CVE-2017-5543
1Intelliants
1Subrion
May 13, 2026
Jan 20, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.
CVE-2014-9120
1Intelliants
1Subrion
May 6, 2026
Dec 10, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to subrion/search/.