en
Instantsoft is the maintainer and developer team associated with InstantCMS, a free and open-source PHP content management and site-management system. The project is designed for self-hosted websites and community-oriented web applications, with extensible content, user-management, administration, templates, and add-ons.
As of 09/15/2026, instantsoft recorded 2 security vulnerabilities in the last 90 days across 1 products, including 0 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, icms2 had the most security vulnerabilities in the instantsoft ecosystem, with 2 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-48707InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning | Exploitation statusPublic exploit | FixNot confirmed | Affected producticms2 | Published09/08/2026 | SeverityLow |
CVE-2026-54611InstantCMS has Remote Code Execution in package installer | Exploitation statusPublic exploit | FixNot confirmed | Affected producticms2 | Published09/08/2026 | SeverityMedium |
CVE-2026-28281InstantCMS has Multiple CSRF Vulnerabilities | Exploitation statusNot known exploited | FixYes | Affected producticms2 | Published03/09/2026 | SeverityHigh |
CVE-2025-59055InstantCMS vulnerable to Server-Side Request Forgery via package installer | Exploitation statusPublic exploit | FixNot confirmed | Affected producticms2 | Published09/11/2025 | SeverityMedium |
CVE-2024-50348InstantCMS has a Cross Site Scripting Vulnerability | Exploitation statusPublic exploit | FixYes | Affected producticms2 | Published10/29/2024 | SeverityMedium |
CVE-2024-31213InstantCMS Open Redirect vulnerability | Exploitation statusPublic exploit | FixNot confirmed | Affected producticms2 | Published04/05/2024 | SeverityLow |
CVE-2024-31212SQL injection in index_chart_data action | Exploitation statusPublic exploit | FixNot confirmed | Affected producticms2 | Published04/04/2024 | SeverityMedium |
CVE-2023-4928SQL Injection in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published09/13/2023 | SeverityHigh |
CVE-2023-4879Cross-site Scripting (XSS) - Stored in instantsoft/icms2 | Exploitation statusNot known exploited | FixYes | Affected productinstantsoft/icms2 | Published09/10/2023 | SeverityLow |
CVE-2023-4878Server-Side Request Forgery (SSRF) in instantsoft/icms2 | Exploitation statusNot known exploited | FixYes | Affected productinstantsoft/icms2 | Published09/10/2023 | SeverityMedium |
CVE-2023-4704External Control of System or Configuration Setting in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published09/01/2023 | SeverityHigh |
CVE-2023-4654Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published08/31/2023 | SeverityLow |
CVE-2023-4655Cross-site Scripting (XSS) - Reflected in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published08/31/2023 | SeverityMedium |
CVE-2023-4650Improper Access Control in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published08/31/2023 | SeverityMedium |
CVE-2023-4649Session Fixation in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published08/31/2023 | SeverityMedium |
CVE-2023-4651Server-Side Request Forgery (SSRF) in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published08/31/2023 | SeverityMedium |
CVE-2023-4653Cross-site Scripting (XSS) - Stored in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published08/31/2023 | SeverityMedium |
CVE-2023-4652Cross-site Scripting (XSS) - Stored in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published08/31/2023 | SeverityMedium |
CVE-2023-4381Unverified Password Change in instantsoft/icms2 | Exploitation statusNot known exploited | FixYes | Affected productinstantsoft/icms2 | Published08/16/2023 | SeverityMedium |
CVE-2023-4189Cross-site Scripting (XSS) - Reflected in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published08/05/2023 | SeverityMedium |
CVE-2023-4188SQL Injection in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published08/05/2023 | SeverityCritical |
CVE-2023-4187Cross-site Scripting (XSS) - Stored in instantsoft/icms2 | Exploitation statusPublic exploit | FixYes | Affected productinstantsoft/icms2 | Published08/05/2023 | SeverityLow |
CVE-2013-6839 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/13/2013 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
