GCVE - cpe:2.3:a:getsymphony:symphony:2.1.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:getsymphony:symphony:2.1.1:*:*:*:*:*:*:*

part: a version: 2.1.1 update: *

Vendor	Getsymphony (`662a4337-afcd-5d5c-beee-1e31578ad7e7`)
Product	Symphony (`02301729-269b-5be2-a6da-7194477d392c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/symphonycms/symphonycms`	purl2cpe	2026-06-01 10:11:24.163719

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-7346`	vulnerable	2026-06-08 05:05:10.042478	Details available Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the sort parameter to system/authors/, related to CVE-2013-2559. Published: 2014-03-27T16:00:00.000Z Updated: 2024-09-17T04:24:38.468Z Open on db.gcve.eu Reference links http://archives.neohapsis.com/archives/bugtraq/2013-04/0018.html https://www.htbridge.com/advisory/HTB23148	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2559`	vulnerable	2026-06-08 05:04:26.805279	Details available SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands. Published: 2014-03-27T16:00:00.000Z Updated: 2024-08-06T15:44:32.088Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/83227 http://archives.neohapsis.com/archives/bugtraq/2013-04/0018.html https://www.htbridge.com/advisory/HTB23148 http://www.securityfocus.com/bid/58843 https://github.com/symphonycms/symphony-2/commit/6c8aa4e9c810994f7632837487426867ce50f468	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-3458`	vulnerable	2026-06-08 04:55:14.733846	Details available SQL injection vulnerability in lib/toolkit/events/event.section.php in Symphony CMS 2.0.7 and 2.1.1 allows remote attackers to execute arbitrary SQL commands via the send-email[recipient] parameter to about/. NOTE: some of these details are obtained from third party information. Published: 2010-09-17T19:00:00.000Z Updated: 2024-08-07T03:11:44.313Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/43180 http://secunia.com/advisories/41379 https://exchange.xforce.ibmcloud.com/vulnerabilities/61749 http://www.exploit-db.com/exploits/14968 http://packetstormsecurity.org/1009-exploits/symphony-sqlxss.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-3457`	vulnerable	2026-06-08 04:55:14.733396	Details available Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.0.7 and 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) fields[website] parameter in the post comments feature in articles/a-primer-to-symphony-2s-default-theme/ or (2) send-email[recipient] parameter to about/. NOTE: some of these details are obtained from third party information. Published: 2010-09-17T19:00:00.000Z Updated: 2024-08-07T03:11:43.749Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/43180 http://secunia.com/advisories/41379 https://exchange.xforce.ibmcloud.com/vulnerabilities/61750 http://www.exploit-db.com/exploits/14968 http://packetstormsecurity.org/1009-exploits/symphony-sqlxss.txt	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.