Intelliants vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-71292 Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_arHigh 7.2 · Aug 5, 2026
• CVE-2024-25400 Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php.Critical 9.8 · Feb 27, 2024
• CVE-2021-43464 A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in iHigh 8.8 · Apr 4, 2022
• CVE-2020-18326 Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthHigh 8.8 · Mar 4, 2022
• CVE-2021-41947 A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode.High 7.2 · Oct 8, 2021
• CVE-2020-18155 SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.Critical 9.8 · Jul 14, 2021
• CVE-2019-7357 Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/.High 8.8 · Nov 10, 2020
• CVE-2019-20390 A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victHigh 8.1 · May 15, 2020
• CVE-2020-12468 Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language.High 7.8 · Apr 29, 2020
• CVE-2018-21037 Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.High 8.8 · Mar 17, 2020
• CVE-2017-18366 Subrion CMS 4.1.5 has CSRF in blog/delete/.High 8.8 · Apr 15, 2019
• CVE-2018-19422 /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.High 7.2 · Nov 21, 2018
• CVE-2017-15063 There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error.High 8.8 · Oct 6, 2017
• CVE-2017-11445 Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.Critical 9.8 · Jul 19, 2017
• CVE-2017-11444 Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.Critical 9.8 · Jul 19, 2017
• CVE-2017-6069 Subrion CMS 4.0.5 has CSRF in admin/blog/add/.High 8.8 · Mar 26, 2017
• CVE-2017-6068 Subrion CMS 4.0.5 has CSRF in admin/blocks/add/.High 8.8 · Mar 26, 2017
• CVE-2017-6066 Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/.High 8.8 · Mar 26, 2017
• CVE-2017-6013 Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter.Critical 9.8 · Mar 26, 2017
• CVE-2017-6002 Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/.High 8.8 · Mar 26, 2017
• CVE-2017-5543 includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt coCritical 9.8 · Jan 20, 2017
• CVE-2012-4772 SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the plan_id parameter.High 7.5 · Oct 22, 2012
• CVE-2011-5212 SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the (1) user name or (2) passwHigh 7.5 · Oct 22, 2012