| CVE-2025-15148 | 高7.2 | A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Template Management Page. Executing a manipulation of the argument content/tempdata can lead to code injection. The attack may be launched remotely. The exploit ha | 28/12/2025 |
| CVE-2025-11332 | 中6.1 | A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php of the component URL Handler. Executing a manipulation of the argument PHP_SELF can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may b | 06/10/2025 |
| CVE-2025-55910 | 中6.3 | CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php. | 19/09/2025 |
| CVE-2025-1336 | 高8.1 | A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimg_action in the library lib/admin/image_admin.php. The manipulation of the argument imgname leads to path traversal. The attack can be launched remotely. The exploit has been disclosed | 16/02/2025 |
| CVE-2025-1335 | 高8.1 | A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimg_action in the library lib/admin/file_admin.php. The manipulation of the argument imgname leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the pub | 16/02/2025 |
| CVE-2025-1106 | 中6.5 | A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/database_admin.php. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may | 07/02/2025 |
| CVE-2025-0973 | 中6.5 | A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_admin.php of the file /index.php?case=database&act=backAll&admin_dir=admin&site=default. The manipulation of the argument select[] leads to path traversal. The at | 03/02/2025 |
| CVE-2024-34315 | 高7.5 | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files. | 07/05/2024 |
| CVE-2024-34314 | 中4.9 | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files. | 07/05/2024 |
| CVE-2024-31551 | 高7.5 | Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request. | 26/04/2024 |
| CVE-2024-32236 | 低3.5 | An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component. | 25/04/2024 |
| CVE-2024-32163 | 中6.4 | CMSeasy 7.7.7.9 is vulnerable to code execution. | 17/04/2024 |
| CVE-2024-32162 | 中4.3 | CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion. | 17/04/2024 |
| CVE-2024-25828 | 中4.9 | cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php. | 22/02/2024 |
| CVE-2024-0523 | 緊急9.8 | A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslide_child_action in the library lib/admin/language_admin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The exploit has been dis | 14/01/2024 |
| CVE-2020-18406 | 高7.5 | An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data. | 27/06/2023 |
| CVE-2023-34880 | 緊急9.8 | cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php. This vulnerability allows attackers to execute arbitrary code and perform a local file inclusion. | 15/06/2023 |
| CVE-2021-42644 | 中6.5 | cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability. | 17/05/2022 |
| CVE-2021-42643 | 高8.8 | cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability. | 17/05/2022 |
| CVE-2019-8434 | 中6.1 | In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter. | 18/02/2019 |