InstantCMS records

22 published records for vendor instantcms.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 1 · 4.5%
Pre-auth RCE: 1
With a fix record: 9.1%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

22 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
38Monitor	CVE-2013-10051Weaponized	InstantCMS <= 1.6 Remote PHP Code Executioninstantcms · instantcms · CWE-95 pre-auth RCE	Critical9.3	—	2.8%	Aug 1, 2025
36Monitor	CVE-2023-4188No exploit	SQL Injection in instantsoft/icms2instantcms · instantcms · CWE-89 Pre-auth SQL injection	Critical9.1	—	0.9%	Aug 5, 2023
28Monitor	CVE-2023-4928No exploit	SQL Injection in instantsoft/icms2instantcms · icms2 · CWE-89 SQL injection	High7.2	—	0.9%	Sep 12, 2023
28Monitor	CVE-2024-31212No exploit	SQL injection in index_chart_data actioninstantcms · instantcms · CWE-20 SQL injection	High7.2	—	0.9%	Apr 4, 2024
28Monitor	CVE-2025-59055No exploit	InstantCMS vulnerable to Server-Side Request Forgery via package installerinstantcms · instantcms · CWE-918 SSRF	High7.2	—	0.5%	Sep 11, 2025
28Monitor	CVE-2026-28281No exploit	InstantCMS has Multiple CSRF Vulnerabilitiesinstantcms · instantcms · CWE-352 Pre-auth CSRF	High7.1	—	0.2%	Mar 10, 2026
24Monitor	CVE-2018-14382No exploit	InstantCMS 2.10.1 has /redirect?url= XSS.instantcms · instantcms · CWE-79 Pre-auth XSS	Medium6.1	—	0.9%	Jul 18, 2018
24Monitor	CVE-2023-4655No exploit	Cross-site Scripting (XSS) - Reflected in instantsoft/icms2instantcms · instantcms · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Aug 30, 2023
21Monitor	CVE-2023-4652No exploit	Cross-site Scripting (XSS) - Stored in instantsoft/icms2instantcms · instantcms · CWE-79 XSS	Medium5.4	—	0.5%	Aug 30, 2023
21Monitor	CVE-2023-4649No exploit	Session Fixation in instantsoft/icms2instantcms · instantcms · CWE-384	Medium5.4	—	0.4%	Aug 30, 2023
21Monitor	CVE-2023-4651No exploit	Server-Side Request Forgery (SSRF) in instantsoft/icms2instantcms · instantcms · CWE-918 SSRF	Medium5.4	—	0.4%	Aug 30, 2023
21Monitor	CVE-2024-31213No exploit	InstantCMS Open Redirect vulnerabilityinstantcms · instantcms · CWE-601 Open redirect	Medium5.4	—	0.4%	Apr 5, 2024
21Monitor	CVE-2023-4878No exploit	Server-Side Request Forgery (SSRF) in instantsoft/icms2instantcms · instantcms · CWE-918 SSRF	Medium5.4	—	0.4%	Sep 10, 2023
21Monitor	CVE-2024-50348No exploit	InstantCMS has a Cross Site Scripting Vulnerabilityinstantcms · instantcms · CWE-79 XSS	Medium5.4	—	0.3%	Oct 29, 2024
19Monitor	CVE-2023-4704No exploit	External Control of System or Configuration Setting in instantsoft/icms2instantcms · instantcms · CWE-15	Medium4.9	—	0.9%	Sep 1, 2023
19Monitor	CVE-2023-4653No exploit	Cross-site Scripting (XSS) - Stored in instantsoft/icms2instantcms · instantcms · CWE-79 XSS	Medium4.8	—	0.5%	Aug 30, 2023
19Monitor	CVE-2023-4187No exploit	Cross-site Scripting (XSS) - Stored in instantsoft/icms2instantcms · instantcms · CWE-79 XSS	Medium4.8	—	0.5%	Aug 5, 2023
19Monitor	CVE-2023-4189No exploit	Cross-site Scripting (XSS) - Reflected in instantsoft/icms2instantcms · instantcms · CWE-79 XSS	Medium4.8	—	0.5%	Aug 5, 2023
19Monitor	CVE-2023-4879No exploit	Cross-site Scripting (XSS) - Stored in instantsoft/icms2instantcms · instantcms · CWE-79 XSS	Medium4.8	—	0.4%	Sep 10, 2023
18Monitor	CVE-2023-4650No exploit	Improper Access Control in instantsoft/icms2instantcms · instantcms · CWE-284 Broken access control (IDOR)	Medium4.7	—	0.5%	Aug 30, 2023
17Monitor	CVE-2023-4381No exploit	Unverified Password Change in instantsoft/icms2instantcms · instantcms · CWE-620	Medium4.3	—	0.4%	Aug 16, 2023
14Monitor	CVE-2023-4654No exploit	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2instantcms · instantcms · CWE-614	Low3.5	—	0.3%	Aug 30, 2023

CVE-2013-10051
38Monitor
InstantCMS <= 1.6 Remote PHP Code Execution
CriticalCVSS 9.3WeaponizedEPSS 3%
- pre-auth RCE
instantcms · instantcmsAug 1, 2025
CVE-2023-4188
36Monitor
SQL Injection in instantsoft/icms2
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- SQL injection
instantcms · instantcmsAug 5, 2023
CVE-2023-4928
28Monitor
SQL Injection in instantsoft/icms2
HighCVSS 7.2No exploitEPSS 1%
- SQL injection
instantcms · icms2Sep 12, 2023
CVE-2024-31212
28Monitor
SQL injection in index_chart_data action
HighCVSS 7.2No exploitEPSS 1%
- SQL injection
instantcms · instantcmsApr 4, 2024
CVE-2025-59055
28Monitor
InstantCMS vulnerable to Server-Side Request Forgery via package installer
HighCVSS 7.2No exploitEPSS 0%
- SSRF
instantcms · instantcmsSep 11, 2025
CVE-2026-28281
28Monitor
InstantCMS has Multiple CSRF Vulnerabilities
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
instantcms · instantcmsMar 10, 2026
CVE-2018-14382
24Monitor
InstantCMS 2.10.1 has /redirect?url= XSS.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
instantcms · instantcmsJul 18, 2018
CVE-2023-4655
24Monitor
Cross-site Scripting (XSS) - Reflected in instantsoft/icms2
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
instantcms · instantcmsAug 30, 2023
CVE-2023-4652
21Monitor
Cross-site Scripting (XSS) - Stored in instantsoft/icms2
MediumCVSS 5.4No exploitEPSS 1%
- XSS
instantcms · instantcmsAug 30, 2023
CVE-2023-4649
21Monitor
Session Fixation in instantsoft/icms2
MediumCVSS 5.4No exploitEPSS 0%
instantcms · instantcmsAug 30, 2023
CVE-2023-4651
21Monitor
Server-Side Request Forgery (SSRF) in instantsoft/icms2
MediumCVSS 5.4No exploitEPSS 0%
- SSRF
instantcms · instantcmsAug 30, 2023
CVE-2024-31213
21Monitor
InstantCMS Open Redirect vulnerability
MediumCVSS 5.4No exploitEPSS 0%
- Open redirect
instantcms · instantcmsApr 5, 2024
CVE-2023-4878
21Monitor
Server-Side Request Forgery (SSRF) in instantsoft/icms2
MediumCVSS 5.4No exploitEPSS 0%
- SSRF
instantcms · instantcmsSep 10, 2023
CVE-2024-50348
21Monitor
InstantCMS has a Cross Site Scripting Vulnerability
MediumCVSS 5.4No exploitEPSS 0%
- XSS
instantcms · instantcmsOct 29, 2024
CVE-2023-4704
19Monitor
External Control of System or Configuration Setting in instantsoft/icms2
MediumCVSS 4.9No exploitEPSS 1%
instantcms · instantcmsSep 1, 2023
CVE-2023-4653
19Monitor
Cross-site Scripting (XSS) - Stored in instantsoft/icms2
MediumCVSS 4.8No exploitEPSS 0%
- XSS
instantcms · instantcmsAug 30, 2023
CVE-2023-4187
19Monitor
Cross-site Scripting (XSS) - Stored in instantsoft/icms2
MediumCVSS 4.8No exploitEPSS 0%
- XSS
instantcms · instantcmsAug 5, 2023
CVE-2023-4189
19Monitor
Cross-site Scripting (XSS) - Reflected in instantsoft/icms2
MediumCVSS 4.8No exploitEPSS 0%
- XSS
instantcms · instantcmsAug 5, 2023
CVE-2023-4879
19Monitor
Cross-site Scripting (XSS) - Stored in instantsoft/icms2
MediumCVSS 4.8No exploitEPSS 0%
- XSS
instantcms · instantcmsSep 10, 2023
CVE-2023-4650
18Monitor
Improper Access Control in instantsoft/icms2
MediumCVSS 4.7No exploitEPSS 1%
- Broken access control (IDOR)
instantcms · instantcmsAug 30, 2023
CVE-2023-4381
17Monitor
Unverified Password Change in instantsoft/icms2
MediumCVSS 4.3No exploitEPSS 0%
instantcms · instantcmsAug 16, 2023
CVE-2023-4654
14Monitor
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2
LowCVSS 3.5No exploitEPSS 0%
instantcms · instantcmsAug 30, 2023