CVE-2019-25703

all versions

ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate databa

7.1HIGH

CVE-2022-50912

all versions

ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially

9.8CRITICAL

CVE-2023-37785

<= 1.4.5

A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HT

4.8MEDIUM

CVE-2022-26986

<= 1.4.3

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an at

7.2HIGH

CVE-2021-26601

< 1.4.3

ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.

8.1HIGH

CVE-2021-26600

< 1.4.3

ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==)

9.8CRITICAL

CVE-2021-26599

< 1.4.4

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.

9.8CRITICAL

CVE-2021-26598

< 1.4.3

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who

5.3MEDIUM

CVE-2022-24977

< 1.4.2

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, le

9.8CRITICAL

CVE-2021-28088

all versions

Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbi

5.4MEDIUM

CVE-2020-17551

all versions

ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.

4.8MEDIUM

CVE-2018-13983

all versions

ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/pag

6.1MEDIUM

CVE-2014-1836

<= 1.3.5

Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote att

CVE-2014-4036

all versions

Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbit

CVE-2012-0987

all versions

Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remot

CVE-2012-0986

all versions

Multiple cross-site scripting (XSS) vulnerabilities in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allow remo

CVE-2010-4616

<= 1.2.3

Cross-site scripting (XSS) vulnerability in modules/content/admin/content.php in ImpressCMS 1.2.3 Final, and possibly other versio

CVE-2010-4271

<= 1.2.3

SQL injection vulnerability in ImpressCMS before 1.2.3 RC2 allows remote attackers to execute arbitrary SQL commands via unspecifi

CVE-2008-6360

all versions

Cross-site scripting (XSS) vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows rem

CVE-2008-5964

<= 1.0.3

Session fixation vulnerability in Social ImpressCMS before 1.1.1 RC1 allows remote attackers to hijack web sessions by setting the

CVE-2008-3453

all versions

Multiple unspecified vulnerabilities in ImpressCMS 1.0 have unknown impact and attack vectors, related to modules/admin.php and "a