CVE-2025-59473HOCH 7.2SQL Injection vulnerability in the Structure for Admin authenticated user
CVE-2023-22953HOCH 8.8In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
CVE-2020-8242HOCH 7.2Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/…
CVE-2021-33199KRITISCH 9.8In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead o…
CVE-2021-27230HOCH 8.8ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save…