Easy CMS is a focused content management system product with a narrow vulnerability footprint centered on the system itself. The observed exposure relates to generalized weakness classes rather than a specific recurrent pattern, making this a compact vendor profile rather than a broad trend line; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Easy Cms over time
Signals from CVEs in this vendor scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-1105CRITICAL A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argument _order leads to sq | Jan 18, 2026 | 9.8 | 34 | NO | NO |
CVE-2022-23358CRITICAL EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used directly to construct a SQ | Feb 16, 2022 | 9.8 | 30 | NO | NO |
CVE-2026-3786HIGH A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Request Parameter Handl | Mar 8, 2026 | 8.8 | 27 | NO | NO |
CVE-2026-3785HIGH A vulnerability was identified in EasyCMS up to 1.6. The affected element is an unknown function of the file /RbacnodeAction.class.php of the component Request Parameter Handler. T | Mar 8, 2026 | 8.8 | 27 | NO | NO |
CVE-2019-6294HIGH An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI. | Jan 15, 2019 | 8.8 | 27 | NO | NO |
CVE-2018-16345HIGH An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/clos | Sep 2, 2018 | 8.8 | 27 | NO | NO |
CVE-2020-24271HIGH A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post | Feb 1, 2021 | 8.8 | 26 | NO | NO |
CVE-2018-16759MEDIUM The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event. | Sep 9, 2018 | 6.1 | 21 | NO | NO |
CVE-2018-12971MEDIUM EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users. | Jun 29, 2018 | 6.5 | 21 | NO | NO |
CVE-2018-17113MEDIUM App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter, a related issue to CVE-2018-9173. | Sep 17, 2018 | 6.1 | 20 | NO | NO |
Signals from CVEs in this vendor scope (16 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Easy Cms.
Media articles that mention a CVE ID that affects a product developed by Easy Cms — matched by CVE ID, not by vendor name.