| CVE-2026-21632 | TRUNG BÌNH5.4 | Lack of output escaping for article titles leads to XSS vectors in various locations. | 01/04/2026 |
| CVE-2026-21631 | TRUNG BÌNH5.4 | Lack of output escaping leads to a XSS vector in the multilingual associations component. | 01/04/2026 |
| CVE-2026-21630 | CAO8.8 | Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint. | 01/04/2026 |
| CVE-2026-21629 | CAO7.3 | The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers. | 01/04/2026 |
| CVE-2025-63083 | TRUNG BÌNH6.1 | Lack of output escaping leads to a XSS vector in the pagebreak plugin. | 06/01/2026 |
| CVE-2025-63082 | TRUNG BÌNH6.1 | Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. | 06/01/2026 |
| CVE-2025-25227 | CAO7.5 | Insufficient state checks lead to a vector that allows to bypass 2FA checks. | 08/04/2025 |
| CVE-2025-25226 | NGHIÊM TRỌNG9.8 | Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited | 08/04/2025 |
| CVE-2024-40749 | CAO7.5 | Improper Access Controls allows access to protected views. | 07/01/2025 |
| CVE-2024-40748 | CAO7.5 | Lack of output escaping in the id attribute of menu lists. | 07/01/2025 |
| CVE-2024-40747 | TRUNG BÌNH6.1 | Various module chromes didn't properly process inputs, leading to XSS vectors. | 07/01/2025 |
| CVE-2024-40743 | TRUNG BÌNH6.1 | The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. | 20/08/2024 |
| CVE-2024-27187 | CAO7.5 | Improper Access Controls allows backend users to overwrite their username when disallowed. | 20/08/2024 |
| CVE-2024-27186 | TRUNG BÌNH6.1 | The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. | 20/08/2024 |
| CVE-2024-27185 | NGHIÊM TRỌNG9.1 | The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. | 20/08/2024 |
| CVE-2024-27184 | TRUNG BÌNH6.1 | Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.. | 20/08/2024 |
| CVE-2024-26279 | TRUNG BÌNH6.1 | The wrapper extensions do not correctly validate inputs, leading to XSS vectors. | 09/07/2024 |
| CVE-2024-26278 | TRUNG BÌNH6.1 | The Custom Fields component not correctly filter inputs, leading to a XSS vector. | 09/07/2024 |
| CVE-2024-21731 | TRUNG BÌNH6.1 | Improper handling of input could lead to an XSS vector in the StringHelper::truncate method. | 09/07/2024 |
| CVE-2024-21730 | TRUNG BÌNH5.4 | The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector. | 09/07/2024 |