Skip to content
Noroxi

Impresscms records

21 published records for vendor impresscms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
38.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

21 records
  • CVE-2021-26599
    45Plan

    ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    impresscms · impresscmsMar 27, 2022

  • CVE-2022-24977
    41Plan

    ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to u

    CriticalCVSS 9.8No exploitEPSS 6%

    impresscms · impresscmsFeb 14, 2022

  • CVE-2021-26600
    41Plan

    ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).

    CriticalCVSS 9.8No exploitEPSS 6%

    impresscms · impresscmsMar 27, 2022

  • CVE-2008-3453
    40Plan

    Multiple unspecified vulnerabilities in ImpressCMS 1.0 have unknown impact and attack vectors, related to modules/admin.php and "a few files

    CriticalCVSS 10.0No exploitEPSS 1%

    impresscms · impresscmsAug 4, 2008

  • CVE-2022-50912
    37Monitor

    ImpressCMS 1.4.4 - Unrestricted File Upload

    CriticalCVSS 9.3No exploitEPSS 1%

    impresscms · impresscmsJan 13, 2026

  • CVE-2021-26601
    33Monitor

    ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.

    HighCVSS 8.1No exploitEPSS 3%

    impresscms · impresscmsMar 27, 2022

  • CVE-2010-4271
    30Monitor

    SQL injection vulnerability in ImpressCMS before 1.2.3 RC2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors

    HighCVSS 7.5No exploitEPSS 1%

    impresscms · impresscmsNov 16, 2010

  • CVE-2022-26986
    29Monitor

    SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to

    HighCVSS 7.2Proof of conceptEPSS 4%

    impresscms · impresscmsApr 5, 2022

  • CVE-2019-25703
    28Monitor

    ImpressCMS 1.3.11 SQL Injection via bid Parameter

    HighCVSS 7.1No exploitEPSS 0%

    impresscms · impresscmsApr 12, 2026

  • CVE-2008-5964
    27Monitor

    Session fixation vulnerability in Social ImpressCMS before 1.1.1 RC1 allows remote attackers to hijack web sessions by setting the PHPSESSID

    MediumCVSS 6.8No exploitEPSS 2%

    impresscms · impresscmsJan 23, 2009

  • CVE-2014-1836
    26Monitor

    Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to

    MediumCVSS 6.4Proof of conceptEPSS 4%

    impresscms · impresscmsJul 1, 2015

  • CVE-2021-26598
    24Monitor

    ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by d

    MediumCVSS 5.3Proof of conceptEPSS 11%

    impresscms · impresscmsMar 27, 2022

  • CVE-2018-13983
    24Monitor

    ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck

    MediumCVSS 6.1No exploitEPSS 2%

    impresscms · impresscmsMay 6, 2019

  • CVE-2012-0987
    24Monitor

    Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remote authenti

    MediumCVSS 6.0No exploitEPSS 2%

    impresscms · impresscmsOct 6, 2012

  • CVE-2021-28088
    21Monitor

    Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web

    MediumCVSS 5.4No exploitEPSS 1%

    impresscms · impresscmsMar 11, 2021

  • CVE-2020-17551
    19Monitor

    ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.

    MediumCVSS 4.8No exploitEPSS 1%

    impresscms · impresscmsOct 7, 2020

  • CVE-2023-37785
    19Monitor

    A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a c

    MediumCVSS 4.8No exploitEPSS 0%

    impresscms · impresscmsJul 13, 2023

  • CVE-2012-0986
    18Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allow remote attacke

    MediumCVSS 4.3No exploitEPSS 2%

    impresscms · impresscmsOct 6, 2012

  • CVE-2010-4616
    17Monitor

    Cross-site scripting (XSS) vulnerability in modules/content/admin/content.php in ImpressCMS 1.2.3 Final, and possibly other versions before

    MediumCVSS 4.3No exploitEPSS 1%

    impresscms · impresscmsDec 29, 2010

  • CVE-2008-6360
    17Monitor

    Cross-site scripting (XSS) vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attack

    MediumCVSS 4.3No exploitEPSS 1%

    impresscms · impresscmsMar 2, 2009

  • CVE-2014-4036
    17Monitor

    Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web s

    MediumCVSS 4.3No exploitEPSS 1%

    impresscms · impresscmsJun 11, 2014