SocialEngine records

8 published records for vendor socialengine.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 3
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

8 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
37Monitor	CVE-2026-41460No exploit	SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberallsocialengine · socialengine · CWE-89 pre-auth RCE SQL injection	Critical9.3	—	1.0%	Apr 23, 2026
30Monitor	CVE-2008-6121No exploit	CRLF injection vulnerability in SocialEngine (SE) 2.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP socialengine · socialengine · CWE-20 Pre-auth	High7.5	—	1.3%	Feb 11, 2009
30Monitor	CVE-2008-6120No exploit	SQL injection vulnerability in profile_comments.php in SocialEngine (SE) 2.7 and earlier allows remote attackers to execute arbitrary SQL cosocialengine · socialengine · CWE-89 pre-auth RCE SQL injection	High7.5	—	1.1%	Feb 11, 2009
27Monitor	CVE-2013-4898Proof of concept	Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authensocialengine · socialengine RCE File upload	Medium6.5	—	3.1%	Jan 29, 2014
27Monitor	CVE-2009-0400Proof of concept	SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL commands via the categorsocialengine · socialengine · CWE-89 pre-auth RCE SQL injection	Medium6.8	—	1.1%	Feb 3, 2009
25Monitor	CVE-2026-41461No exploit	SocialEngine <= 7.8.0 Blind SSRF via /core/link/previewsocialengine · socialengine · CWE-918 SSRF	Medium6.3	—	0.5%	Apr 23, 2026
25Monitor	CVE-2012-6721No exploit	Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) Forum, (2) Event, and (3) Classifieds plugins in SocialEngine before 4socialengine · socialengine · CWE-352 Pre-auth CSRF	Medium6.3	—	0.3%	Feb 11, 2020
24Monitor	CVE-2012-6720No exploit	Multiple cross-site scripting (XSS) vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTsocialengine · socialengine · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	Feb 11, 2020

CVE-2026-41460
37Monitor
SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- SQL injection
socialengine · socialengineApr 23, 2026
CVE-2008-6121
30Monitor
CRLF injection vulnerability in SocialEngine (SE) 2.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
socialengine · socialengineFeb 11, 2009
CVE-2008-6120
30Monitor
SQL injection vulnerability in profile_comments.php in SocialEngine (SE) 2.7 and earlier allows remote attackers to execute arbitrary SQL co
HighCVSS 7.5No exploitEPSS 1%
- pre-auth RCE
- SQL injection
socialengine · socialengineFeb 11, 2009
CVE-2013-4898
27Monitor
Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authen
MediumCVSS 6.5Proof of conceptEPSS 3%
- RCE
- File upload
socialengine · socialengineJan 29, 2014
CVE-2009-0400
27Monitor
SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL commands via the categor
MediumCVSS 6.8Proof of conceptEPSS 1%
- pre-auth RCE
- SQL injection
socialengine · socialengineFeb 3, 2009
CVE-2026-41461
25Monitor
SocialEngine <= 7.8.0 Blind SSRF via /core/link/preview
MediumCVSS 6.3No exploitEPSS 0%
- SSRF
socialengine · socialengineApr 23, 2026
CVE-2012-6721
25Monitor
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) Forum, (2) Event, and (3) Classifieds plugins in SocialEngine before 4
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
- CSRF
socialengine · socialengineFeb 11, 2020
CVE-2012-6720
24Monitor
Multiple cross-site scripting (XSS) vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HT
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
socialengine · socialengineFeb 11, 2020