lmxcms records
11 published records for vendor lmxcms.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 2
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')5
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')2
- CWE-94 Improper Control of Generation of Code ('Code Injection')2
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-552 Files or Directories Accessible to External Parties1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
11 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2023-46958No exploit | An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file.lmxcms · lmxcms · CWE-94 | Critical9.8 | — | 1.2% | Nov 2, 2023 |
39Monitor | CVE-2021-35437No exploit | SQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the TagsAction.class.lmxcms · lmxcms · CWE-89 | Critical9.8 | — | 0.9% | Nov 16, 2023 |
39Monitor | CVE-2023-29598No exploit | lmxcms v1.4.1 was discovered to contain a SQL injection vulnerability via the setbook parameter at index.php.lmxcms · lmxcms · CWE-89 | Critical9.8 | — | 0.6% | Apr 13, 2023 |
39Monitor | CVE-2023-5017No exploit | lmxcms admin.php sql injectionlmxcms · lmxcms · CWE-89 | Critical9.8 | — | 0.5% | Sep 16, 2023 |
39Monitor | CVE-2023-1321No exploit | lmxcms AcquisiAction.class.php update sql injectionlmxcms · lmxcms · CWE-89 | Critical9.8 | — | 0.4% | Mar 10, 2023 |
39Monitor | CVE-2023-1322No exploit | lmxcms BookAction.class.php reply sql injectionlmxcms · lmxcms · CWE-89 | Critical9.8 | — | 0.4% | Mar 10, 2023 |
26Monitor | CVE-2023-23136No exploit | lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php.lmxcms · lmxcms · CWE-22 | Medium6.5 | — | 0.8% | Feb 1, 2023 |
21Monitor | CVE-2025-4541No exploit | LmxCMS POST Request ZtAction.class.php manageZt sql injectionlmxcms · lmxcms · CWE-74 | Medium5.3 | — | 0.5% | May 11, 2025 |
20Monitor | CVE-2024-8523No exploit | lmxcms SQL Command Execution Module admin.php formatData code injectionlmxcms · lmxcms · CWE-94 | Medium5.1 | — | 0.9% | Sep 7, 2024 |
19Monitor | CVE-2022-48094No exploit | lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.lmxcms · lmxcms · CWE-552 | Medium4.9 | — | 0.6% | Feb 1, 2023 |
8Monitor | CVE-2025-1465No exploit | lmxcms Maintenance db.inc.php code injectionlmxcms · lmxcms · CWE-74 | Low2.1 | — | 0.5% | Feb 19, 2025 |
- CVE-2023-4695839Monitor
An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file.
CriticalCVSS 9.8No exploitEPSS 1%lmxcms · lmxcmsNov 2, 2023
- CVE-2021-3543739Monitor
SQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the TagsAction.class.
CriticalCVSS 9.8No exploitEPSS 0%lmxcms · lmxcmsNov 16, 2023
- CVE-2023-2959839Monitor
lmxcms v1.4.1 was discovered to contain a SQL injection vulnerability via the setbook parameter at index.php.
CriticalCVSS 9.8No exploitEPSS 0%lmxcms · lmxcmsApr 13, 2023
- CVE-2023-501739Monitor
lmxcms admin.php sql injection
CriticalCVSS 9.8No exploitEPSS 0%lmxcms · lmxcmsSep 16, 2023
- CVE-2023-132139Monitor
lmxcms AcquisiAction.class.php update sql injection
CriticalCVSS 9.8No exploitEPSS 0%lmxcms · lmxcmsMar 10, 2023
- CVE-2023-132239Monitor
lmxcms BookAction.class.php reply sql injection
CriticalCVSS 9.8No exploitEPSS 0%lmxcms · lmxcmsMar 10, 2023
- CVE-2023-2313626Monitor
lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php.
MediumCVSS 6.5No exploitEPSS 0%lmxcms · lmxcmsFeb 1, 2023
- CVE-2025-454121Monitor
LmxCMS POST Request ZtAction.class.php manageZt sql injection
MediumCVSS 5.3No exploitEPSS 0%lmxcms · lmxcmsMay 11, 2025
- CVE-2024-852320Monitor
lmxcms SQL Command Execution Module admin.php formatData code injection
MediumCVSS 5.1No exploitEPSS 0%lmxcms · lmxcmsSep 7, 2024
- CVE-2022-4809419Monitor
lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.
MediumCVSS 4.9No exploitEPSS 0%lmxcms · lmxcmsFeb 1, 2023
- CVE-2025-14658Monitor
lmxcms Maintenance db.inc.php code injection
LowCVSS 2.1No exploitEPSS 0%lmxcms · lmxcmsFeb 19, 2025