Easycms Project maintains a lightweight web content management system whose vulnerability profile centers on the core Easycms product and input-handling issues endemic to web applications, particularly cross-site scripting in page-generation contexts. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Easycms Project over time
Signals from CVEs in this vendor scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-1105CRITICAL A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argument _order leads to sq | Jan 18, 2026 | 9.8 | 34 | NO | NO |
CVE-2022-23358CRITICAL EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used directly to construct a SQ | Feb 16, 2022 | 9.8 | 30 | NO | NO |
CVE-2026-3786HIGH A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Request Parameter Handl | Mar 8, 2026 | 8.8 | 27 | NO | NO |
CVE-2026-3785HIGH A vulnerability was identified in EasyCMS up to 1.6. The affected element is an unknown function of the file /RbacnodeAction.class.php of the component Request Parameter Handler. T | Mar 8, 2026 | 8.8 | 27 | NO | NO |
CVE-2019-6294HIGH An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI. | Jan 15, 2019 | 8.8 | 27 | NO | NO |
CVE-2018-16345HIGH An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/clos | Sep 2, 2018 | 8.8 | 27 | NO | NO |
CVE-2020-24271HIGH A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post | Feb 1, 2021 | 8.8 | 26 | NO | NO |
CVE-2018-16759MEDIUM The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event. | Sep 9, 2018 | 6.1 | 21 | NO | NO |
CVE-2018-12971MEDIUM EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users. | Jun 29, 2018 | 6.5 | 21 | NO | NO |
CVE-2018-17113MEDIUM App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter, a related issue to CVE-2018-9173. | Sep 17, 2018 | 6.1 | 20 | NO | NO |
Signals from CVEs in this vendor scope (16 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Easycms Project.
Media articles that mention a CVE ID that affects a product developed by Easycms Project — matched by CVE ID, not by vendor name.