PatchTheCVEs-cms vulnerabilities
Recent CVEs affecting s-cms products. 9 tracked.
s-cms has 9 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 0. Most recent: 2024-01-04. Highest priority: CVE-2023-51052 (score 51/100).
- CVE-2023-7191 MEDIUM 5.5 DOWNGRADE A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006
- CVE-2023-7190 MEDIUM 5.5 DOWNGRADE A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006
- CVE-2023-7189 MEDIUM 5.5 DOWNGRADE A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006
- CVE-2023-51052 CRITICAL 9.8 DOWNGRADE S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax
- CVE-2023-51051 CRITICAL 9.8 DOWNGRADE S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax
- CVE-2023-51050 CRITICAL 9.8 DOWNGRADE S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/a
- CVE-2023-51049 CRITICAL 9.8 DOWNGRADE S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.
- CVE-2023-51048 CRITICAL 9.8 DOWNGRADE S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax
- CVE-2023-29962 MEDIUM 6.5 DOWNGRADE S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.
FAQ
How do I fix s-cms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is s-cms being exploited right now?
None of the tracked s-cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which s-cms CVE should I patch first?
CVE-2023-51052 currently ranks highest (51/100): S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.