Cmscout is a narrowly scoped content-management or web-application platform where the recurring vulnerability profile centers on input-handling and access-control weaknesses including path traversal, SQL injection, and cross-site scripting. The vendor's disclosures have a strong tendency toward public exploit availability, reflecting the appeal of web-application flaws for rapid tooling and proof-of-concept development. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cmscout over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2010-5059HIGH SQL injection vulnerability in index.php in CMScout 2.0.8 allows remote attackers to execute arbitrary SQL commands via the album parameter in a photos action. | Nov 23, 2011 | 7.5 | 33 | NO | YES |
CVE-2007-3812HIGH SQL injection vulnerability in forums.php in CMScout 1.23 and earlier allows remote attackers to execute arbitrary SQL commands via the f parameter in a forums action to index.php. | Jul 17, 2007 | 7.5 | 30 | NO | YES |
CVE-2008-3415HIGH Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory | Jul 31, 2008 | 7.5 | 29 | NO | YES |
CVE-2010-2154MEDIUM Cross-site scripting (XSS) vulnerability in the Search Site in CMScout 2.09, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the sea | Jun 3, 2010 | 4.3 | 25 | NO | YES |
CVE-2008-6726MEDIUM Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot do | Apr 17, 2009 | 6.0 | 25 | NO | YES |
CVE-2008-6725MEDIUM Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) index.php in a mythings page ( | Apr 17, 2009 | 6.0 | 24 | NO | YES |
CVE-2006-2188MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in CMScout 1.10 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Body field of a private me | May 4, 2006 | 6.8 | 19 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cmscout.
Media articles that mention a CVE ID that affects a product developed by Cmscout — matched by CVE ID, not by vendor name.