Expressionengine vulnerabilities

Products

• Expressionengine 15

Newest

• expressionengine SQL Injection vulnerability in the Structure for Admin authenticated user CVE-2025-59473 6.0 MediumJanuary 26, 2026
• expressionengine ExpressionEngine before 7.4.11 allows XSS. CVE-2024-38454 6.1 MediumJune 16, 2024
• expressionengine Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker,... CVE-2021-44534 6.5 MediumMay 31, 2024
• expressionengine In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated... CVE-2023-22953 8.8 HighFebruary 9, 2023
• expressionengine Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL... CVE-2020-8242 7.2 HighFebruary 18, 2022
• expressionengine In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted... CVE-2021-33199 9.8 CriticalAugust 12, 2021
• expressionengine ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain... CVE-2021-27230 8.8 HighMarch 15, 2021
• expressionengine ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a ... CVE-2020-13443 8.8 HighJune 24, 2020
• expressionengine ExpressionEngine before 4.3.5 has reflected XSS. CVE-2018-17874 6.1 MediumOctober 1, 2018
• expressionengine EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code... CVE-2017-1000160 5.4 MediumNovember 17, 2017
• ellislab expressionengine ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with... CVE-2017-0897 7.5 HighJune 22, 2017
• ellislab expressionengine Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote... CVE-2014-5387 6.5 MediumNovember 4, 2014
• expressionengine Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1... CVE-2009-1070 Public exploit 4.3 MediumMarch 24, 2009
• expressionengine CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote... CVE-2008-0202 4.3 MediumJanuary 10, 2008
• expressionengine Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier... CVE-2008-0201 4.3 MediumJanuary 10, 2008