Subrion
26 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Subrion, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
Subrion CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 1 |
| 2026-09 | 0 |
Severity
How the 26 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High6
- Medium17
Latest CVEs
The 15 most recently published vulnerabilities affecting Subrion.
- CVE-2026-71292Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter7.2
- CVE-2024-25400Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. NOTE: this is disputed by multiple third parties because it refers to an HTTP request to a PHP file that only contains a cla...9.8
- CVE-2023-46947Subrion 4.2.1 has a remote command execution vulnerability in the backend.8.8
- CVE-2023-43884A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in...5.4
- CVE-2023-43830A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several...5.4
- CVE-2023-43828A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter.5.4
- CVE-2021-41948A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".5.4
- CVE-2020-22330Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.6.1
- CVE-2020-18155SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.9.8
- CVE-2020-23761Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab.6.1
- CVE-2019-7356Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.5.4
- CVE-2019-20390A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authen...8.1
- CVE-2019-20389An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[language_switch] parameter (within m...6.1
- CVE-2020-12467Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.6.5
- CVE-2020-12468Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/.7.8
Product grouping is registry-driven, with AI assist and human review. How it works