phpwcms 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に パス処理の欠陥 and vendor risk cross-site scripting などに関し、一部は vendor impact data exposure を招き、vendor surface production workloads and vendor surface software deployment 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2021-47783 | Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform. | [email protected] | 5.3 | 0.28% | 2026-01-15 | 2026-06-17 |
| CVE-2025-5499 | A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component. | [email protected] | 6.9 | 0.64% | 2025-06-03 | 2026-06-17 |
| CVE-2025-5498 | A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of the file include/inc_lib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpage_custom leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is r | [email protected] | 5.1 | 0.42% | 2025-06-03 | 2026-06-17 |
| CVE-2025-5497 | A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to resolve this issue. The patch is named 41a72eca0baa9d9d0214fec97db2 | [email protected] | 2.1 | 0.46% | 2025-06-03 | 2026-06-17 |
| CVE-2021-36426 | File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php. | [email protected] | 8.8 | 1.06% | 2023-02-03 | 2026-06-16 |
| CVE-2021-36425 | Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file. | [email protected] | 5.4 | 0.97% | 2023-02-03 | 2026-06-16 |
| CVE-2021-36424 | An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation. | [email protected] | 9.8 | 1.18% | 2023-02-03 | 2026-06-16 |
| CVE-2021-4301 | A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is identified as 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability. | [email protected] | 6.3 | 0.69% | 2023-01-07 | 2026-06-17 |
| CVE-2021-4302 | A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is named b39db9c7ad3800f319195ff0e26a0981395b1c54. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217419. | [email protected] | 3.5 | 0.53% | 2023-01-04 | 2026-06-17 |
| CVE-2020-19855 | phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php. | [email protected] | 6.1 | 0.64% | 2021-09-07 | 2026-06-16 |
| CVE-2020-21784 | phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php. | [email protected] | 9.8 | 1.40% | 2021-06-24 | 2026-06-16 |
| CVE-2018-12990 | phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field. | [email protected] | 5.3 | 1.18% | 2018-06-30 | 2026-06-16 |
| CVE-2017-15872 | phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmpl.php and include/inc_tmpl/admin.newuser.tmpl.php via the username (aka new_login) field. | [email protected] | 4.8 | 0.51% | 2017-10-24 | 2026-06-16 |
| CVE-2011-3789 | phpwcms 1.4.7 r412 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by template/inc_script/frontend_render/disabled/majonavi.php and certain other files. | [email protected] | 5.0 | 1.23% | 2011-09-23 | 2026-06-16 |
| CVE-2006-7019 | phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via crafted arguments to the (1) text_evento and (2) email_eventonome_evento parameters to phpwcms_code_snippets/mail_file_form.php and sample_ext_php/mail_file_form.php, which is processed by the render_PHPcode function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. | [email protected] | 7.5 | 2.46% | 2007-02-14 | 2026-06-16 |
| CVE-2006-6886 | phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for (1) files.public-userroot.inc.php or (2) files.private.additions.inc.php in include/inc_lib/, which reveals the path in various error messages. | [email protected] | 5.0 | 1.57% | 2006-12-31 | 2026-06-16 |
| CVE-2006-2519 | Directory traversal vulnerability in include/inc_ext/spaw/spaw_control.class.php in phpwcms 1.2.5-DEV allows remote attackers to include arbitrary local files via .. (dot dot) sequences in the spaw_root parameter. NOTE: CVE analysis suggests that this issue is actually in SPAW Editor PHP Edition. | [email protected] | 2.6 | 1.62% | 2006-05-22 | 2026-06-16 |
| CVE-2006-2518 | Cross-site scripting (XSS) vulnerability in phpwcms 1.2.5-DEV allows remote attackers to inject arbitrary web script or HTML via the BL[be_cnt_plainhtml] parameter to include/inc_tmpl/content/cnt6.inc.php. | [email protected] | 2.6 | 1.36% | 2006-05-22 | 2026-06-16 |
| CVE-2005-3789 | Multiple directory traversal vulnerabilities in phpwcms 1.2.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) form_lang parameter in login.php and (2) the imgdir parameter in random_image.php. | [email protected] | 5.0 | 3.42% | 2005-11-24 | 2026-06-16 |