ImpressCMS vulnerabilities
We track 4 vulnerabilities in ImpressCMS products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 14, 2026.
Latest ImpressCMS vulnerabilities
- 7.2 High severity
ImpressCMS: Improper Control of Generation of Code
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decod
- 9.8 Critical severity
ImpressCMS: Unrestricted Upload of File with Dangerous Type
ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to e
- 7.2 High severity
Impresscms: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can e
- 9.8 Critical severity
Impresscms: Improper Limitation of a Pathname to a Restricted Directory
ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS wh