Approved changes feed: RSS · Atom
cpe:2.3:a:phpwcms:phpwcms:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Phpwcms (0556bc97-66d9-577f-8228-8f84217d637a) |
|---|---|
| Product | Phpwcms (dba03076-cabc-5681-981e-344a5199e4e4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/slackero/phpwcms |
purl2cpe | 2026-06-01 10:17:39.690802 |
pkg:sourceforge/phpwcms |
purl2cpe | 2026-06-01 10:17:39.690803 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-110025 |
vulnerable | 2026-11-03 10:16:01.212045 |
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
HIGH (7.3)
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.
Published: 2026-10-13T15:41:34.677Z
Updated: 2026-10-15T15:11:53.863Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5499 |
vulnerable | 2026-06-08 07:37:24.960471 |
slackero phpwcms image_resized.php getimagesize deserialization
HIGH (7.3)
A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.
Published: 2025-06-03T13:31:07.203Z
Updated: 2025-06-03T13:42:05.740Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5498 |
vulnerable | 2026-06-08 07:37:24.959937 |
slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization
MEDIUM (5.5)
A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of the file include/inc_lib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpage_custom leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.
Published: 2025-06-03T13:31:05.263Z
Updated: 2025-06-03T13:45:36.390Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5497 |
vulnerable | 2026-06-08 07:37:24.959177 |
slackero phpwcms Feedimport processing.inc.php deserialization
MEDIUM (6.3)
A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to resolve this issue. The patch is named 41a72eca0baa9d9d0214fec97db2400bc082d2a9. It is recommended to upgrade the affected component.
Published: 2025-06-03T13:00:16.567Z
Updated: 2025-08-20T08:53:07.592Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-4302 |
vulnerable | 2026-06-08 05:38:09.143115 |
slackero phpwcms SVG File cross site scripting
LOW (3.5)
A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is named b39db9c7ad3800f319195ff0e26a0981395b1c54. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217419.
Published: 2023-01-04T21:24:19.710Z
Updated: 2025-04-10T13:39:52.749Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-4301 |
vulnerable | 2026-06-08 05:38:09.142335 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-47783 |
vulnerable | 2026-06-08 05:38:07.625046 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36426 |
vulnerable | 2026-06-08 05:32:52.209387 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36425 |
vulnerable | 2026-06-08 05:32:52.209042 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36424 |
vulnerable | 2026-06-08 05:32:52.208524 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2006-7019 |
vulnerable | 2026-06-08 04:49:30.167706 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.