MI
Product
Minicms
35
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 5Medium 22Low 2
Watch
Add Minicms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-15455 | 6.5 | Jan 5 | bg5sbk MiniCMS File Recovery Request page.php delete_page improper authentication Affected: through 1.8 |
| CVE-2019-9603 | 6.5 | Mar 6 | MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891 Affected: 1.10 |
| CVE-2024-31741 | 6.1 | Apr 26 | Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after login Affected: 1.11 |
| CVE-2021-41663 | 6.1 | Jun 13 | A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11 Affected: 1.11 |
| CVE-2020-17999 | 6.1 | Apr 28 | Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component… Affected: 1.10 |
| CVE-2019-13186 | 6.1 | Jul 3 | In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box Affected: 1.10 |
| CVE-2018-20520 | 6.1 | Dec 27 | MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233 Affected: 1.10 |
| CVE-2018-17039 | 6.1 | Sep 14 | MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled Affected: 1.10 |
| CVE-2018-16298 | 6.1 | Aug 31 | An issue was discovered in MiniCMS 1.10 Affected: 1.10 |
| CVE-2018-16233 | 6.1 | Aug 30 | MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter Affected: 1.10 |
| CVE-2018-15899 | 6.1 | Aug 27 | An issue was discovered in MiniCMS 1.10 Affected: 1.10 |
| CVE-2018-1000638 | 6.1 | Aug 20 | MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code injection Affected: 1.1 |
| CVE-2018-10296 | 6.1 | Apr 22 | MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter Affected: 1.10 |
| CVE-2023-46378 | 5.4 | Oct 31 | Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php Affected: 1.11 |
| CVE-2021-44970 | 5.4 | Feb 10 | MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php Affected: 1.11 |
| CVE-2018-10227 | 5.4 | Apr 19 | MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link parameter Affected: 1.10 |
| CVE-2018-18890 | 5.3 | Nov 1 | MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename Affected: 1.10 |
| CVE-2019-13341 | 4.8 | Jul 5 | In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie Affected: 1.10 |
| CVE-2019-13340 | 4.8 | Jul 5 | In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box Affected: 1.10 |
| CVE-2019-13339 | 4.8 | Jul 5 | In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie Affected: 1.10 |
| CVE-2024-9282 | 4.3 | Sep 27 | bg5sbk MiniCMS page-edit.php cross-site request forgery Affected: before 1.11 |
| CVE-2024-9281 | 4.3 | Sep 27 | bg5sbk MiniCMS post-edit.php cross-site request forgery Affected: before 1.11 |
Showing 22