Approved changes feed: RSS · Atom
cpe:2.3:a:intelliants:subrion:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Intelliants (9a16356f-578e-53eb-80d8-4986d008ffd2) |
|---|---|
| Product | Subrion (f6c1d03c-5c54-5551-acbc-a7f5ea672965) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:dockerintelliants/subrion |
purl2cpe | 2026-06-01 10:16:57.248887 |
pkg:github/intelliants/subrion |
purl2cpe | 2026-06-01 10:16:57.248890 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-71292 |
vulnerable | 2026-09-16 04:32:59.488949 |
Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter
HIGH (7.2)
Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.
Published: 2026-08-05T12:38:43.068Z
Updated: 2026-08-10T11:47:26.159Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41948 |
vulnerable | 2026-06-08 05:35:21.250896 |
Details available
A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".
Published: 2022-04-29T13:41:22.000Z
Updated: 2024-08-04T03:22:25.701Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-23761 |
vulnerable | 2026-06-08 05:22:32.090643 |
Details available
Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab.
Published: 2021-04-09T17:49:15.000Z
Updated: 2024-08-04T15:05:10.816Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12469 |
vulnerable | 2026-06-08 05:17:58.235548 |
Details available
admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.
Published: 2020-04-29T19:58:37.000Z
Updated: 2024-08-04T11:56:52.046Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-21037 |
vulnerable | 2026-06-08 05:11:28.363957 |
Details available
Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.
Published: 2020-03-17T14:53:17.000Z
Updated: 2024-08-05T12:19:27.535Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11317 |
vulnerable | 2026-06-08 05:10:38.347430 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-15063 |
vulnerable | 2026-06-08 05:08:57.810580 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9120 |
vulnerable | 2026-06-08 05:06:10.918936 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.