Aggregates CVE and security vulnerability intelligence across all snewscms-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Disclosed issues often relate to vendor risk cross-site scripting and vendor risk csrf; exposure may include vendor impact session compromise in vendor surface software deployment and vendor surface production workloads contexts.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2016-20052 | Snews CMS 1.7 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files including PHP executables to the snews_files directory. Attackers can upload malicious PHP files through the multipart form-data upload endpoint and execute them by accessing the uploaded file path to achieve remote code execution. | [email protected] | 9.3 | 0.95% | 2026-04-04 | 2026-06-16 |
| CVE-2016-20051 | Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that submits POST requests to the changeup action, modifying the admin username and password parameters to gain unauthorized access. | [email protected] | 6.9 | 0.16% | 2026-04-04 | 2026-06-16 |
| CVE-2011-2706 | A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71. | [email protected] | 6.1 | 0.70% | 2020-01-14 | 2026-06-16 |
| CVE-2007-5303 | Cross-site scripting (XSS) vulnerability in news_page.php in SnewsCMS Rus 2.1 allows remote attackers to inject arbitrary web script or HTML via the page_id parameter. | [email protected] | 4.3 | 1.03% | 2007-10-09 | 2026-06-16 |