GCVE - cpe:2.3:a:instantsoft:instantcms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:instantsoft:instantcms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Instantsoft (`9eccb52c-3803-500c-971d-53a1e7a95264`)
Product	Instantcms (`4f512c53-8543-53f3-8fde-585db7f83d05`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/instantsoft/icms2`	purl2cpe	2026-06-01 10:13:00.618089

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-31213`	vulnerable	2026-06-08 06:35:31.109266	InstantCMS Open Redirect vulnerability LOW (3.5) InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available. Published: 2024-04-05T14:43:06.893Z Updated: 2024-08-02T01:46:04.416Z Open on db.gcve.eu Reference links https://github.com/instantsoft/icms2/security/advisories/GHSA-6v3c-p92q-prfq	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-4189`	vulnerable	2026-06-08 06:16:11.732121	Cross-site Scripting (XSS) - Reflected in instantsoft/icms2 MEDIUM (4.8) Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Published: 2023-08-05T19:17:54.146Z Updated: 2024-10-09T18:33:19.405Z Open on db.gcve.eu Reference links https://huntr.dev/bounties/b00e6986-64e7-464e-ba44-e42476bfcdc4 https://github.com/instantsoft/icms2/commit/1dbc3e6c8fbf5d2dc551cb27fad0de3584dee40f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-4188`	vulnerable	2026-06-08 06:16:11.731429	SQL Injection in instantsoft/icms2 CRITICAL (9.8) SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Published: 2023-08-05T19:10:37.764Z Updated: 2024-10-09T18:41:52.449Z Open on db.gcve.eu Reference links https://huntr.dev/bounties/fe9809b6-40ad-4e81-9197-a9aa42e8a7bf https://github.com/instantsoft/icms2/commit/1dbc3e6c8fbf5d2dc551cb27fad0de3584dee40f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-4187`	vulnerable	2026-06-08 06:16:11.729156	Cross-site Scripting (XSS) - Stored in instantsoft/icms2 LOW (3.5) Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Published: 2023-08-05T17:17:59.755Z Updated: 2024-10-09T18:44:07.718Z Open on db.gcve.eu Reference links https://huntr.dev/bounties/14941381-b669-4756-94fc-cce172472f8b https://github.com/instantsoft/icms2/commit/1dbc3e6c8fbf5d2dc551cb27fad0de3584dee40f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-6839`	vulnerable	2026-06-08 05:05:07.138813	Details available SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to catalog/[id]. Published: 2013-12-13T15:00:00.000Z Updated: 2024-08-06T17:46:23.764Z Open on db.gcve.eu Reference links http://secunia.com/advisories/56041 http://www.instantcms.ru/novosti/security-update-1-10-3.html https://www.htbridge.com/advisory/HTB23185 http://archives.neohapsis.com/archives/bugtraq/2013-12/0049.html http://www.securityfocus.com/bid/63842	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.