Technology · Packagist

intelliants/subrion (Packagist) vulnerabilities

Updated 28 September 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 43 vulnerabilities in intelliants/subrion (Packagist): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-12202, was published on 15 June 2026.

Last 7 days: 0
Last 90 days: 0
Critical, all time: 1
Exploited in the wild: 0

About intelliants/subrion (Packagist)

Subrion is an open-source content management system written in PHP.

Latest intelliants/subrion (Packagist) vulnerabilities

CVE-2026-12202: Intelliants Subrion CMS stored XSS in Blocks EndpointlowCVSS 3.1EPSS 0.2%15 Jun 2026
CVE-2025-70958: Subrion CMS vulnerable to cross-site scriptinglowCVSS 3.1EPSS 0.3%3 Feb 2026
CVE-2025-56556: Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query toollowCVSS 3.1EPSS 0.2%11 Sep 2025
CVE-2024-25399: Subrion CMS vulnerable to Cross Site ScriptinglowCVSS 3.1EPSS 0.4%27 Feb 2024
CVE-2024-25400: Withdrawn Advisory: Subrion CMS vulnerable to SQL InjectioninfoEPSS 0.7%27 Feb 2024
CVE-2023-46947: Subrion remote command execution vulnerabilitylowCVSS 3.1EPSS 1.3%3 Nov 2023
CVE-2023-43875: Subrion CMS vulnerable to Cross-site ScriptinglowCVSS 3.1EPSS 0.8%20 Oct 2023
CVE-2023-43884: Subrion CMS Cross-site Scripting vulnerabilitylowCVSS 3.1EPSS 0.4%28 Sep 2023
CVE-2023-43828: Subrion CMS Cross-site Scripting vulnerability in /panel/languageslowCVSS 3.1EPSS 0.5%27 Sep 2023
CVE-2023-43830: Subrion CMS XSS in /panel/configuration/financial/lowCVSS 3.1EPSS 0.5%27 Sep 2023
CVE-2022-43121: Subrion CMS is vulnerable to Cross-Site Scripting (XSS)lowCVSS 3.1EPSS 0.6%9 Nov 2022
CVE-2022-43120: Subrion CMS is vulnerable to Cross-Site Scripting (XSS)lowCVSS 3.1EPSS 0.5%9 Nov 2022
CVE-2022-37059: Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panellowCVSS 3.1EPSS 0.6%29 Aug 2022
CVE-2021-41502: Cross site scripting in intelliants/subrionlowCVSS 3.1EPSS 0.5%12 Jun 2022
CVE-2020-22330: Subrion Cross-Site Scripting (XSS) vulnerabilitylowCVSS 3.1EPSS 0.6%24 May 2022
CVE-2020-23761: subrion CMS Cross Site Scripting (XSS) vulnerabilitylowCVSS 3.1EPSS 1.0%24 May 2022
CVE-2019-7357: Subrion CMS CSRF VulnerabilitylowCVSS 3.1EPSS 1.4%24 May 2022
CVE-2019-20389: Subrion CMS XSSlowCVSS 3.1EPSS 0.9%24 May 2022
CVE-2019-20390: Subrion CMS Cross-Site Request Forgery (CSRF) vulnerabilitylowCVSS 3.1EPSS 0.7%24 May 2022
CVE-2020-12468: Subrion CMS CSV injection via Export LanguagelowCVSS 3.1EPSS 0.9%24 May 2022
CVE-2020-12469: Subrion CMS PHP Object InjectionlowCVSS 3.1EPSS 0.9%24 May 2022
CVE-2018-21037: Subrion CMS CSRF VulnerabilitylowCVSS 3.1EPSS 0.5%24 May 2022
CVE-2018-11317: Subrion CMS XSSlowCVSS 3EPSS 0.9%24 May 2022
CVE-2018-14835: Subrion CMS XSSlowCVSS 3EPSS 0.7%14 May 2022
CVE-2017-10795: Subrion Cross-site scripting (XSS) vulnerabilitylowCVSS 3EPSS 1.1%14 May 2022

Most severe intelliants/subrion (Packagist) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2017-5543: Intelliants Subrion CMS PHP Object Injection in ia.core.users.phpcriticalCVSS 9.8EPSS 2.1%20 Jan 2017
CVE-2018-19422: Subrion CMS RCE VulnerabilitylowCVSS 3.1EPSS 64.3%13 May 2022
CVE-2020-18326: Cross Site Request Forgery in intelliants/subrionlowCVSS 3.1EPSS 2.2%5 Mar 2022
CVE-2020-18324: Cross-site Scripting in Subrion CMSlowCVSS 3.1EPSS 2.2%5 Mar 2022
CVE-2020-18325: Cross-site Scripting in intelliants/subrionlowCVSS 3.1EPSS 1.6%5 Mar 2022
CVE-2021-43464: Remote code execution in SubrionlowCVSS 3.1EPSS 1.4%5 Apr 2022
CVE-2019-7357: Subrion CMS CSRF VulnerabilitylowCVSS 3.1EPSS 1.4%24 May 2022
CVE-2020-18155: SQL Injection in Subrion CMSlowCVSS 3.1EPSS 1.3%8 Sep 2021
CVE-2023-46947: Subrion remote command execution vulnerabilitylowCVSS 3.1EPSS 1.3%3 Nov 2023
CVE-2020-23761: subrion CMS Cross Site Scripting (XSS) vulnerabilitylowCVSS 3.1EPSS 1.0%24 May 2022

Vulnerabilities per week

The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Bar	Vulns	Critical
6 Jul 2026		0	0
13 Jul 2026		0	0
20 Jul 2026		0	0
27 Jul 2026		0	0
3 Aug 2026		0	0
10 Aug 2026		0	0
17 Aug 2026		0	0
24 Aug 2026		0	0
31 Aug 2026		0	0
7 Sep 2026		0	0
14 Sep 2026		0	0
21 Sep 2026		0	0
28 Sep 2026		0	0

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/intelliants-subrion.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "intelliants/subrion (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/intelliants-subrion, 28 September 2026.