| CVE-2025-59473 | 高7.2 | SQL Injection vulnerability in the Structure for Admin authenticated user | 26/01/2026 |
| CVE-2024-38454 | 中6.1 | ExpressionEngine before 7.4.11 allows XSS. | 16/06/2024 |
| CVE-2023-22953 | 高8.8 | In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user. | 09/02/2023 |
| CVE-2020-8242 | 高7.2 | Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack. | 18/02/2022 |
| CVE-2021-33199 | 緊急9.8 | In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file names of icon.png and icon.svg. | 12/08/2021 |
| CVE-2021-27230 | 高8.8 | ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory. | 15/03/2021 |
| CVE-2020-13443 | 高8.8 | ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user with low privileges (member) is able to upload this. It is possible to bypass the MIME type check and file-extension check while uploading new f | 24/06/2020 |
| CVE-2018-17874 | 中6.1 | ExpressionEngine before 4.3.5 has reflected XSS. | 01/10/2018 |
| CVE-2017-1000160 | 中5.4 | EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection | 17/11/2017 |
| CVE-2017-0897 | 高7.5 | ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution. | 22/06/2017 |
| CVE-2014-5387 | 中6.5 | Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module to system/index.php. | 04/11/2014 |
| CVE-2009-1070 | 中4.3 | Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the avatar parameter. | 26/03/2009 |
| CVE-2008-0202 | 中4.3 | CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter. | 10/01/2008 |
| CVE-2008-0201 | 中4.3 | Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameter. | 10/01/2008 |