PortfolioCMS Project maintains a focused portfolio-management application that faces a recurring set of web-application vulnerabilities centered on input handling, authentication, and request validation. The disclosures cluster around cross-site request forgery, SQL injection, improper file upload handling, race conditions, and authentication weaknesses that are characteristic of web platforms managing user content and permissions. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Portfoliocms Project over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-15848HIGH An issue was discovered in portfolioCMS 1.0.5. There is CSRF to create new pages via admin/portfolio.php?newpage=true. | Aug 25, 2018 | 8.8 | 27 | NO | NO |
CVE-2021-36532HIGH Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost/admin/uploads.php. | Feb 3, 2023 | 8.1 | 26 | NO | NO |
CVE-2020-20402HIGH Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation. | Jan 31, 2023 | 7.5 | 25 | NO | NO |
CVE-2018-12263HIGH portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI. | Jun 13, 2018 | 8.8 | 25 | NO | NO |
CVE-2018-12110HIGH portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter. | Jun 11, 2018 | 7.2 | 21 | NO | NO |
CVE-2018-15849MEDIUM An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php. | Aug 25, 2018 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Portfoliocms Project.
Media articles that mention a CVE ID that affects a product developed by Portfoliocms Project — matched by CVE ID, not by vendor name.