Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters.
References
| Link | Resource |
|---|---|
| https://github.com/emirhanyucell/Subrion-CMS-4.2.1/blob/main/subrion-cms-exploit.txt | Exploit Third Party Advisory |
Configurations
History
11 Feb 2026, 20:33
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:intelliants:subrion_cms:4.2.1:*:*:*:*:*:*:* | |
| References | () https://github.com/emirhanyucell/Subrion-CMS-4.2.1/blob/main/subrion-cms-exploit.txt - Exploit, Third Party Advisory | |
| First Time |
Intelliants subrion Cms
Intelliants |
03 Feb 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CWE | CWE-79 |
02 Feb 2026, 23:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-02 23:16
Updated : 2026-02-11 20:33
NVD link : CVE-2025-70958
Mitre link : CVE-2025-70958
CVE.ORG link : CVE-2025-70958
JSON object : View
Products Affected
intelliants
- subrion_cms
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')