cmseasy 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
公開された問題は vendor risk cross-site scripting、vendor risk csrf, and vendor risk sql injection に関連することが多く、vendor surface software deployment and vendor surface production workloads の文脈で vendor impact session compromise and vendor impact data exposure などの暴露リスクを伴う場合があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2025-15148 | A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Template Management Page. Executing a manipulation of the argument content/tempdata can lead to code injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 2.0 | 0.03% | 2025-12-28 | 2026-04-29 |
| CVE-2025-11332 | A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php of the component URL Handler. Executing a manipulation of the argument PHP_SELF can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 2.0 | 0.03% | 2025-10-06 | 2026-04-29 |
| CVE-2025-55910 | CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php. | [email protected] | 6.3 | 0.06% | 2025-09-19 | 2025-09-25 |
| CVE-2025-1336 | A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimg_action in the library lib/admin/image_admin.php. The manipulation of the argument imgname leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 5.3 | 0.17% | 2025-02-16 | 2025-02-28 |
| CVE-2025-1335 | A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimg_action in the library lib/admin/file_admin.php. The manipulation of the argument imgname leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 5.3 | 0.15% | 2025-02-16 | 2025-02-28 |
| CVE-2025-1106 | A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/database_admin.php. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 5.3 | 0.04% | 2025-02-07 | 2025-03-04 |
| CVE-2025-0973 | A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_admin.php of the file /index.php?case=database&act=backAll&admin_dir=admin&site=default. The manipulation of the argument select[] leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 5.3 | 0.04% | 2025-02-03 | 2025-02-28 |
| CVE-2024-34315 | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files. | [email protected] | 7.5 | 0.26% | 2024-05-07 | 2025-04-14 |
| CVE-2024-34314 | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files. | [email protected] | 4.9 | 0.16% | 2024-05-07 | 2025-03-14 |
| CVE-2024-31551 | Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request. | [email protected] | 7.5 | 0.55% | 2024-04-26 | 2025-04-14 |
| CVE-2024-32236 | An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component. | [email protected] | 3.5 | 0.05% | 2024-04-25 | 2025-04-14 |
| CVE-2024-32163 | CMSeasy 7.7.7.9 is vulnerable to code execution. | [email protected] | 6.4 | 0.07% | 2024-04-17 | 2025-04-14 |
| CVE-2024-32162 | CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion. | [email protected] | 4.3 | 0.13% | 2024-04-17 | 2025-04-14 |
| CVE-2024-25828 | cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php. | [email protected] | 4.9 | 0.16% | 2024-02-22 | 2025-04-03 |
| CVE-2024-0523 | A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslide_child_action in the library lib/admin/language_admin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250693 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond i | [email protected] | 6.3 | 0.04% | 2024-01-14 | 2024-11-21 |
| CVE-2020-18406 | An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data. | [email protected] | 7.5 | 0.07% | 2023-06-27 | 2024-11-21 |
| CVE-2023-34880 | cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php. This vulnerability allows attackers to execute arbitrary code and perform a local file inclusion. | [email protected] | 9.8 | 0.17% | 2023-06-15 | 2024-11-21 |
| CVE-2021-42644 | cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability. | [email protected] | 6.5 | 0.36% | 2022-05-17 | 2024-11-21 |
| CVE-2021-42643 | cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability. | [email protected] | 8.8 | 0.44% | 2022-05-17 | 2024-11-21 |
| CVE-2019-8434 | In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter. | [email protected] | 6.1 | 0.21% | 2019-02-18 | 2024-11-21 |