Expressionengine: >> Expressionengine >> 5.4.2 Security Vulnerabilities
ExpressionEngine before 7.4.11 allows XSS.
CVSS Score
6.1
EPSS Score
0.002
Published
2024-06-16
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
CVSS Score
8.8
EPSS Score
0.015
Published
2023-02-09
In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file names of icon.png and icon.svg.
CVSS Score
9.8
EPSS Score
0.004
Published
2021-08-12