cmseasy records
23 published records for vendor cmseasy.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')8
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3
- CWE-352 Cross-Site Request Forgery (CSRF)2
- CWE-459 Incomplete Cleanup1
- CWE-522 Insufficiently Protected Credentials1
- CWE-552 Files or Directories Accessible to External Parties1
The weakness classes this vendor ships most often: where to look.
CWEAll records
23 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2023-34880No exploit | cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.phpcmseasy · cmseasy · CWE-22 | Critical9.8 | — | 1.0% | Jun 15, 2023 |
39Monitor | CVE-2024-0523No exploit | CmsEasy language_admin.php getslide_child_action sql injectioncmseasy · cmseasy · CWE-89 | Critical9.8 | — | 0.7% | Jan 14, 2024 |
36Monitor | CVE-2021-42643No exploit | cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability.cmseasy · cmseasy · CWE-22 | High8.8 | — | 1.7% | May 17, 2022 |
35Monitor | CVE-2018-11679No exploit | An issue was discovered in CmsEasy 6.1_20180508.cmseasy · cmseasy · CWE-352 | High8.8 | — | 0.5% | Jun 2, 2018 |
30Monitor | CVE-2024-31551No exploit | Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via ccmseasy · cmseasy · CWE-26 | High7.5 | — | 0.6% | Apr 26, 2024 |
30Monitor | CVE-2024-34315No exploit | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action methcmseasy · cmseasy · CWE-22 | High7.5 | — | 0.6% | May 7, 2024 |
30Monitor | CVE-2020-18406No exploit | An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data.cmseasy · cmseasy · CWE-522 | High7.5 | — | 0.3% | Jun 27, 2023 |
26Monitor | CVE-2021-42644No exploit | cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability.cmseasy · cmseasy · CWE-552 | Medium6.5 | — | 0.9% | May 17, 2022 |
26Monitor | CVE-2018-11680No exploit | An issue was discovered in CmsEasy 6.1_20180508.cmseasy · cmseasy · CWE-352 | Medium6.5 | — | 0.4% | Jun 2, 2018 |
25Monitor | CVE-2024-32163No exploit | CMSeasy 7.7.7.9 is vulnerable to code execution.cmseasy · cmseasy · CWE-22 | Medium6.4 | — | 0.3% | Apr 17, 2024 |
25Monitor | CVE-2025-55910No exploit | CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.cmseasy · cmseasy · CWE-459 | Medium6.3 | — | 0.2% | Sep 19, 2025 |
24Monitor | CVE-2019-8434No exploit | In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter.cmseasy · cmseasy · CWE-79 | Medium6.1 | — | 0.7% | Feb 17, 2019 |
24Monitor | CVE-2019-8432No exploit | In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter.cmseasy · cmseasy · CWE-79 | Medium6.1 | — | 0.7% | Feb 17, 2019 |
21Monitor | CVE-2025-1336No exploit | CmsEasy image_admin.php deleteimg_action path traversalcmseasy · cmseasy · CWE-22 | Medium5.3 | — | 1.0% | Feb 16, 2025 |
21Monitor | CVE-2025-1106No exploit | CmsEasy database_admin.php restore_action path traversalcmseasy · cmseasy · CWE-22 | Medium5.3 | — | 0.9% | Feb 7, 2025 |
21Monitor | CVE-2025-1335No exploit | CmsEasy file_admin.php deleteimg_action path traversalcmseasy · cmseasy · CWE-22 | Medium5.3 | — | 0.9% | Feb 16, 2025 |
21Monitor | CVE-2025-0973No exploit | CmsEasy index.php backAll_action path traversalcmseasy · cmseasy · CWE-22 | Medium5.3 | — | 0.8% | Feb 2, 2025 |
19Monitor | CVE-2024-25828No exploit | cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.cmseasy · cmseasy · CWE-27 | Medium4.9 | — | 0.6% | Feb 22, 2024 |
19Monitor | CVE-2024-34314No exploit | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action methodcmseasy · cmseasy · CWE-98 | Medium4.9 | — | 0.4% | May 7, 2024 |
17Monitor | CVE-2024-32162No exploit | CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.cmseasy · cmseasy · CWE-791 | Medium4.3 | — | 0.4% | Apr 17, 2024 |
14Monitor | CVE-2024-32236No exploit | An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php compocmseasy · cmseasy · CWE-922 | Low3.5 | — | 0.4% | Apr 25, 2024 |
8Monitor | CVE-2025-15148No exploit | CmsEasy Backend Template Management template_admin.php savetemp_action code injectioncmseasy · cmseasy · CWE-74 | Low2.0 | — | 0.4% | Dec 28, 2025 |
8Monitor | CVE-2025-11332No exploit | CmsEasy URL view.php cross site scriptingcmseasy · cmseasy · CWE-79 | Low2.0 | — | 0.3% | Oct 6, 2025 |
- CVE-2023-3488039Monitor
cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php
CriticalCVSS 9.8No exploitEPSS 1%cmseasy · cmseasyJun 15, 2023
- CVE-2024-052339Monitor
CmsEasy language_admin.php getslide_child_action sql injection
CriticalCVSS 9.8No exploitEPSS 0%cmseasy · cmseasyJan 14, 2024
- CVE-2021-4264336Monitor
cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability.
HighCVSS 8.8No exploitEPSS 1%cmseasy · cmseasyMay 17, 2022
- CVE-2018-1167935Monitor
An issue was discovered in CmsEasy 6.1_20180508.
HighCVSS 8.8No exploitEPSS 0%cmseasy · cmseasyJun 2, 2018
- CVE-2024-3155130Monitor
Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via c
HighCVSS 7.5No exploitEPSS 0%cmseasy · cmseasyApr 26, 2024
- CVE-2024-3431530Monitor
CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action meth
HighCVSS 7.5No exploitEPSS 0%cmseasy · cmseasyMay 7, 2024
- CVE-2020-1840630Monitor
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data.
HighCVSS 7.5No exploitEPSS 0%cmseasy · cmseasyJun 27, 2023
- CVE-2021-4264426Monitor
cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability.
MediumCVSS 6.5No exploitEPSS 0%cmseasy · cmseasyMay 17, 2022
- CVE-2018-1168026Monitor
An issue was discovered in CmsEasy 6.1_20180508.
MediumCVSS 6.5No exploitEPSS 0%cmseasy · cmseasyJun 2, 2018
- CVE-2024-3216325Monitor
CMSeasy 7.7.7.9 is vulnerable to code execution.
MediumCVSS 6.4No exploitEPSS 0%cmseasy · cmseasyApr 17, 2024
- CVE-2025-5591025Monitor
CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.
MediumCVSS 6.3No exploitEPSS 0%cmseasy · cmseasySep 19, 2025
- CVE-2019-843424Monitor
In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter.
MediumCVSS 6.1No exploitEPSS 0%cmseasy · cmseasyFeb 17, 2019
- CVE-2019-843224Monitor
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter.
MediumCVSS 6.1No exploitEPSS 0%cmseasy · cmseasyFeb 17, 2019
- CVE-2025-133621Monitor
CmsEasy image_admin.php deleteimg_action path traversal
MediumCVSS 5.3No exploitEPSS 1%cmseasy · cmseasyFeb 16, 2025
- CVE-2025-110621Monitor
CmsEasy database_admin.php restore_action path traversal
MediumCVSS 5.3No exploitEPSS 0%cmseasy · cmseasyFeb 7, 2025
- CVE-2025-133521Monitor
CmsEasy file_admin.php deleteimg_action path traversal
MediumCVSS 5.3No exploitEPSS 0%cmseasy · cmseasyFeb 16, 2025
- CVE-2025-097321Monitor
CmsEasy index.php backAll_action path traversal
MediumCVSS 5.3No exploitEPSS 0%cmseasy · cmseasyFeb 2, 2025
- CVE-2024-2582819Monitor
cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.
MediumCVSS 4.9No exploitEPSS 0%cmseasy · cmseasyFeb 22, 2024
- CVE-2024-3431419Monitor
CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method
MediumCVSS 4.9No exploitEPSS 0%cmseasy · cmseasyMay 7, 2024
- CVE-2024-3216217Monitor
CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.
MediumCVSS 4.3No exploitEPSS 0%cmseasy · cmseasyApr 17, 2024
- CVE-2024-3223614Monitor
An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php compo
LowCVSS 3.5No exploitEPSS 0%cmseasy · cmseasyApr 25, 2024
- CVE-2025-151488Monitor
CmsEasy Backend Template Management template_admin.php savetemp_action code injection
LowCVSS 2.0No exploitEPSS 0%cmseasy · cmseasyDec 28, 2025
- CVE-2025-113328Monitor
CmsEasy URL view.php cross site scripting
LowCVSS 2.0No exploitEPSS 0%cmseasy · cmseasyOct 6, 2025