CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 11/09/2025 |
| CVE-2024-25400 | 严重9.8 | Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. NOTE: this is disputed by multiple third parties because it refers to an HTTP request to a PHP file that only contains a class, without any mechanism for accepting external input, and the reportedly vulnerable method is not present in the file. | 27/02/2024 |
| CVE-2024-25399 | 中危6.1 | Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. | 27/02/2024 |
| CVE-2023-46947 | 高危8.8 | Subrion 4.2.1 has a remote command execution vulnerability in the backend. | 03/11/2023 |
| CVE-2023-43875 | 中危6.1 | Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail. | 19/10/2023 |
| CVE-2023-43884 | 中危5.4 | A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' parameter. | 28/09/2023 |
| CVE-2023-43830 | 中危5.4 | A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum deposit', 'Maximum deposit' and/or 'Maximum balance'. | 27/09/2023 |
| CVE-2023-43828 | 中危5.4 | A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter. | 27/09/2023 |
| CVE-2022-43121 | 中危6.1 | A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tooltip text field. | 09/11/2022 |
| CVE-2022-43120 | 中危6.1 | A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field default value text field. | 09/11/2022 |
| CVE-2022-37059 | 中危4.8 | Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field | 29/08/2022 |
| CVE-2021-41502 | 中危5.4 | An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or adding the onerror attribute. | 11/06/2022 |
| CVE-2021-41948 | 中危5.4 | A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects". | 29/04/2022 |
| CVE-2021-43464 | 高危8.8 | A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval(). | 04/04/2022 |
| CVE-2020-18326 | 高危8.8 | Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary administrator user. | 04/03/2022 |
| CVE-2020-18325 | 中危6.1 | Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. | 04/03/2022 |
| CVE-2020-18324 | 中危6.1 | Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. | 04/03/2022 |
| CVE-2020-22330 | 中危6.1 | Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. | 06/08/2021 |