SQL Injection in ImpressCMS

CRITICAL 9.8CVE-2021-26599 · GHSA-jc4v-vvg6-xg78 · Published 28/03/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
impresscms/impresscms Packagist	`< 1.4.3`	`1.4.3`
impresscms impresscms	`< 1.4.4`	`1.4.4`

Description

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.

NVD description

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.