Instantcms vulnerabilities
We track 3 vulnerabilities in Instantcms products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on March 10, 2026.
Latest Instantcms vulnerabilities
- 7.1 High severity
icms2: Cross-Site Request Forgery
InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on b
- 7.2 High severity
icms2: Server-Side Request Forgery
InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It
- 7.2 High severity
icms2: Improper Neutralization of Special Elements used in an SQL Command
InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in