GCVE - cpe:2.3:a:intelliants:subrion:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:intelliants:subrion:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Intelliants (`9a16356f-578e-53eb-80d8-4986d008ffd2`)
Product	Subrion (`f6c1d03c-5c54-5551-acbc-a7f5ea672965`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:dockerintelliants/subrion`	purl2cpe	2026-06-01 10:16:57.248887
`pkg:github/intelliants/subrion`	purl2cpe	2026-06-01 10:16:57.248890

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-41948`	vulnerable	2026-06-08 05:35:21.250896	Details available A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects". Published: 2022-04-29T13:41:22.000Z Updated: 2024-08-04T03:22:25.701Z Open on db.gcve.eu Reference links https://github.com/intelliants/subrion-plugin-contact_us/issues/8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-23761`	vulnerable	2026-06-08 05:22:32.090643	Details available Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab. Published: 2021-04-09T17:49:15.000Z Updated: 2024-08-04T15:05:10.816Z Open on db.gcve.eu Reference links https://subrion.org/ http://hidden-one.co.in/2021/04/09/cve-2020-23761-stored-xss-vulnerability-in-subrion-cms-version/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12469`	vulnerable	2026-06-08 05:17:58.235548	Details available admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit. Published: 2020-04-29T19:58:37.000Z Updated: 2024-08-04T11:56:52.046Z Open on db.gcve.eu Reference links https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-21037`	vulnerable	2026-06-08 05:11:28.363957	Details available Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI. Published: 2020-03-17T14:53:17.000Z Updated: 2024-08-05T12:19:27.535Z Open on db.gcve.eu Reference links https://github.com/intelliants/subrion/issues/638	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-11317`	vulnerable	2026-06-08 05:10:38.347430	Details available Subrion CMS before 4.1.4 has XSS. Published: 2019-07-03T15:37:18.000Z Updated: 2024-08-05T08:01:52.855Z Open on db.gcve.eu Reference links https://github.com/intelliants/subrion/blob/610b21d3ff185bd287d55fe016d4266abf04a3bf/includes/classes/ia.admin.sitemap.php#L79-L83 https://github.com/intelliants/subrion/releases/tag/v4.1.4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-15063`	vulnerable	2026-06-08 05:08:57.810580	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9120`	vulnerable	2026-06-08 05:06:10.918936	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.