← Back

S Cms

s-cms

Vendor: S Cms • 41 CVEs

CVEs (41)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-29962
1S Cms
1S Cms
Jun 3, 2025
Jan 4, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.
CVE-2023-7191
1S Cms
1S Cms
Nov 21, 2024
Dec 31, 2023
N/A· v4
8.8 HIGH· v3
5.2 MEDIUM· v2
A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006. This affects an unknown part of the file member/reg.php. The manipulation of the argument M_login/M_email leads to s...Show more
A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006. This affects an unknown part of the file member/reg.php. The manipulation of the argument M_login/M_email leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249393 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-7190
1S Cms
1S Cms
Nov 21, 2024
Dec 31, 2023
N/A· v4
8.8 HIGH· v3
5.2 MEDIUM· v2
A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006. Affected by this issue is some unknown functionality of the file /member/ad.php?action=ad. The manipulation of...Show more
A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006. Affected by this issue is some unknown functionality of the file /member/ad.php?action=ad. The manipulation of the argument A_text/A_url/A_contact leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249392. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-7189
1S Cms
1S Cms
Nov 21, 2024
Dec 31, 2023
N/A· v4
8.8 HIGH· v3
5.2 MEDIUM· v2
A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006. Affected by this vulnerability is an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the a...Show more
A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006. Affected by this vulnerability is an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the argument lid leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249391. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-51052
1S Cms
1S Cms
Apr 24, 2025
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php.
CVE-2023-51051
1S Cms
1S Cms
Nov 21, 2024
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php.
CVE-2023-51050
1S Cms
1S Cms
Nov 21, 2024
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php.
CVE-2023-51049
1S Cms
1S Cms
Nov 21, 2024
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.
CVE-2023-51048
1S Cms
1S Cms
Nov 21, 2024
Dec 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.
CVE-2023-29963
1S Cms
1S Cms
Jan 29, 2025
May 5, 2023
N/A· v4
7.2 HIGH· v3
N/A· v2
S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.
CVE-2022-4377
1S Cms
1S Cms
Nov 21, 2024
Dec 9, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the ar...Show more
A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215197 was assigned to this vulnerability.Show less
CVE-2022-23336
1S Cms
1S Cms
Nov 21, 2024
Feb 14, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.
CVE-2020-20426
1S Cms
1S Cms
Nov 21, 2024
Dec 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.
CVE-2020-20425
1S Cms
1S Cms
Nov 21, 2024
Dec 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.
CVE-2020-19954
1S Cms
1S Cms
Nov 21, 2024
Oct 14, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.
CVE-2020-19158
1S Cms
1S Cms
Nov 21, 2024
Sep 15, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin/#/app/config/'.
CVE-2020-20340
1S Cms
1S Cms
Nov 21, 2024
Sep 1, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database information.
CVE-2020-19046
1S Cms
1S Cms
Nov 21, 2024
Aug 31, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.
CVE-2020-20701
1S Cms
1S Cms
Nov 21, 2024
Jul 30, 2021
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2020-20700
1S Cms
1S Cms
Nov 21, 2024
Jul 30, 2021
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Title Entry text box.