repository icon
instantsoft / icms2 Project repository

Self-hosted Site Management System

Submit a report

FIRST INTERACTION

WITHIN19 DAYS

REVIEW

WITHIN24 DAYS

FIX

WITHIN22 DAYS

Mass Message Feature XSS Vulnerability: Potential Session Hijacking
gabriel-vernilo
Low
Unnoticed HTML Injection Vulnerability Enables Silent Redirection to Malicious W...
ernkw
self closed
Email Enumeration On Password Reset Endpoint
1d8
not applicable
Logout page does not prevent CSRF
nyeooo
Low
logout csrf
nyeooo
self closed
SQL Injection in `icms2/install/index.php`
ghostdragozn
Low
Store XSS in module name "admin/controllers/edit/comments/comments_list"
ngductung
Medium
No Protection Against Bruteforce Attacks on Login Page
sospiro014
informative
Low
Stored XSS at LOGO+USER menu
tishamanandhar
Low
Store XSS in Widgets and pages in instantsoft/icms2
sospiro014
Low
SQL Injection Vulnerability in Content Page
ghostdragozn
High
•CVE-2023-4928
Blind XSS Vulnerability
vipercalling
not applicable
No Rate-Limit Protection at all allowing any User to send unlimited Amount of co...
ahmedvienna
not applicable
Incomplete fix for SSRF in CVE-2023-4651
asesidaa
Medium
•CVE-2023-4878
Source code disclosure
imsushantkamble
not applicable
Store XSS in Notifications Menu
hainguyen0207
Low
Server - Side Request Forgery by unauthorized users
khoiminhvo32
duplicate
Medium
Store XSS in Widgets and pages
hainguyen0207
Low
•CVE-2023-4879
Toastr 2.1.0 in use which is vulnerable to XSS
popcorn94
informative
Low
Stored Cross-site Scripting
newb3ast
Low
Sensitive Information leakage in EXIF data of images
nilabhrajpoot
informative
High
Admin TakeOver
7h3h4ckv157
informative
Medium
Cookie without Secure flag
uonghoangminhchau
Low
•CVE-2023-4654
Authentication cookie is not renewed after successfully login
uonghoangminhchau
Medium
•CVE-2023-4649
XSS at file uploading
uonghoangminhchau
Medium
•CVE-2023-4655
New password can be set as same as the old password
uonghoangminhchau
Medium
•CVE-2023-4381
By pass rate limit in post likes
hainguyen0207
not applicable
SSRF Blind in the image upload module via url
trunggg02
Medium
•CVE-2023-4651
Misconfiguration in message sending function
trunggg02
High
•CVE-2023-4704
authorized Admin Account Takeover
j0x1nx
Medium
•CVE-2023-4650
Store XSS via Upload Photos in album
meme-dm
Medium
•CVE-2023-4652
Reflected XSS in module name "My messages"
hainguyen0207
self closed
Store XSS in module name "admin/controllers/edit/comments/comments_list"
hainguyen0207
Medium
•CVE-2023-4653
Reflected XSS in module name "Write a comment"
hainguyen0207
not applicable
Self XSS in "Content Types / Add Content Type"
meme-dm
Medium
Reflected XSS in URL path of '/admin/controllers/edit/activity/perms/'
legpains
Medium
•CVE-2023-4189
Unauthenticated Blind SQL Injection in '/tags/autocomplete'
legpains
Critical
•CVE-2023-4188
Stored XSS in title
scgajge12
Low
•CVE-2023-4187
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
0xdhinu
duplicate
Medium