CouchCMS 2.3
Approved changes feed: RSS · Atom
cpe:2.3:a:couchcms:couchcms:2.3:*:*:*:*:*:*:*
part: a version: 2.3 update: *
| Vendor | Couchcms (8a7e681e-a47a-590f-ac99-4424695c23c4) |
|---|---|
| Product | Couchcms (45b252fe-2c01-529f-941e-ea62ba572c73) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/couchcms/couchcms |
purl2cpe | 2026-06-01 10:12:31.929823 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-41609 |
vulnerable | 2026-06-08 06:11:06.237976 |
Details available
An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.
Published: 2023-09-11T00:00:00.000Z
Updated: 2024-09-26T17:37:33.014Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-47958 |
vulnerable | 2026-06-08 05:38:07.990370 |
CouchCMS 2.2.1 Server-Side Request Forgery via SVG upload
MEDIUM (4.3)
CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal services and resources.
Published: 2026-05-15T18:36:26.824Z
Updated: 2026-05-15T22:56:00.813Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-47955 |
vulnerable | 2026-06-08 05:38:07.981673 |
CouchCMS 2.2.1 Cross-Site Scripting via SVG File Upload
MEDIUM (5.4)
CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploading malicious SVG files through the file upload functionality. Attackers can upload SVG files containing embedded script tags to the browse.php endpoint, which are then executed in users' browsers when the files are accessed or previewed.
Published: 2026-05-16T15:26:07.851Z
Updated: 2026-05-24T01:37:13.685Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.