CouchCMS Vulnerabilities and Affected Products
Vulnerabilities associated with CouchCMS.
Products
Clear product- CouchCMS3 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-47955MEDIUM | CouchCMS 2.2.1 Cross-Site Scripting via SVG File UploadCouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploading malicious SVG files through the file upload functionality. Attackers can upload SVG files containing embedded script tags to the browse.php endpoint, which are then executed in users' browsers when the files are accessed or previewed. CWE-79May 16, 2026 | CVSS5.1v4.0 | EPSS0.172% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-47958MEDIUM | CouchCMS 2.2.1 Server-Side Request Forgery via SVG uploadCouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal services and resources. CWE-918May 15, 2026 | CVSS5.3v4.0 | EPSS0.238% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-29002HIGH | CouchCMS Privilege Escalation via f_k_levels_list ParameterCouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin account creation and privilege assignment. CWE-639Apr 10, 2026 | CVSS8.6v4.0 | EPSS0.427% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |