Skip to content
Noroxi

phome records

17 published records for vendor phome.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 21
  4. 22
  5. 24
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

17 records
  • CVE-2018-18869
    40Plan

    EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e

    CriticalCVSS 9.8No exploitEPSS 3%

    phome · empirecmsOct 31, 2018

  • CVE-2020-22937
    40Plan

    A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious c

    CriticalCVSS 9.8No exploitEPSS 2%

    phome · empirecmsAug 17, 2021

  • CVE-2018-20300
    39Monitor

    Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this

    CriticalCVSS 9.8No exploitEPSS 1%

    phome · empirecmsDec 19, 2018

  • CVE-2022-28585
    39Monitor

    EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php

    CriticalCVSS 9.8No exploitEPSS 0%

    phome · empirecmsMay 3, 2022

  • CVE-2018-18086
    35Monitor

    EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users.

    HighCVSS 8.8No exploitEPSS 1%

    phome · empirecmsOct 9, 2018

  • CVE-2018-18449
    35Monitor

    EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16

    HighCVSS 8.8No exploitEPSS 0%

    phome · empirecmsMar 7, 2019

  • CVE-2018-16339
    35Monitor

    An issue was discovered in EmpireCMS 7.0.

    HighCVSS 8.8No exploitEPSS 0%

    phome · empirecmsSep 2, 2018

  • CVE-2018-19462
    29Monitor

    admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filenam

    HighCVSS 7.2No exploitEPSS 2%

    phome · empirecmsJun 7, 2019

  • CVE-2012-5777
    28Monitor

    Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assi

    MediumCVSS 6.8No exploitEPSS 2%

    phome · empirecmsNov 15, 2012

  • CVE-2023-50162
    28Monitor

    SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the Do

    HighCVSS 7.2No exploitEPSS 0%

    phome · empirecmsJan 8, 2024

  • CVE-2019-12362
    24Monitor

    EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.

    MediumCVSS 6.1No exploitEPSS 0%

    phome · empirecmsMay 27, 2019

  • CVE-2019-12361
    24Monitor

    EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page tem

    MediumCVSS 6.1No exploitEPSS 0%

    phome · empirecmsMay 27, 2019

  • CVE-2018-6881
    22Monitor

    EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.

    MediumCVSS 5.3No exploitEPSS 2%

    dedecms · dedecmsFeb 11, 2018

  • CVE-2018-6880
    22Monitor

    EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php.

    MediumCVSS 5.3No exploitEPSS 1%

    phome · empirecmsFeb 11, 2018

  • CVE-2025-15422
    22Monitor

    EmpireSoft EmpireCMS IP Address connect.php egetip protection mechanism

    MediumCVSS 5.5No exploitEPSS 1%

    phome · empirecmsJan 2, 2026

  • CVE-2018-19461
    19Monitor

    admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.

    MediumCVSS 4.8No exploitEPSS 0%

    phome · empirecmsJun 7, 2019

  • CVE-2025-15423
    8Monitor

    EmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted upload

    LowCVSS 2.1No exploitEPSS 0%

    phome · empirecmsJan 2, 2026