Composer intelliants/subrion has 42 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2018-19422 | Subrion CMS RCE Vulnerability | high | 7.2 | <4.2.2 | 4.2.2 |
| CVE-2018-14840 | Subrion CMS Cross-site Scripting | medium | 6.1 | <4.2.2 | 4.2.2 |
| CVE-2020-18326 | Cross Site Request Forgery in intelliants/subrion | high | 8.8 | <=4.2.1 | – |
| CVE-2020-18324 | Cross-site Scripting in Subrion CMS | medium | 6.1 | <=4.2.1 | – |
| CVE-2017-5543 | Subrion CMS PHP Object Injection | critical | 9.8 | >=4.0.5 and <4.1.0 | 4.1.0 |
| CVE-2020-18325 | Cross-site Scripting in intelliants/subrion | medium | 6.1 | <=4.2.1 | – |
| CVE-2021-43464 | Remote code execution in Subrion | high | 8.8 | <=4.2.1 | – |
| CVE-2019-7357 | Subrion CMS CSRF Vulnerability | high | 8.8 | <=4.2.1 | – |
| CVE-2020-18155 | SQL Injection in Subrion CMS | critical | 9.8 | <=4.2.1 | – |
| CVE-2023-46947 | Subrion remote command execution vulnerability | high | 7.2 | <=4.2.1 | – |
| CVE-2017-10795 | Subrion Cross-site scripting (XSS) vulnerability | medium | 6.1 | <4.1.6 | 4.1.6 |
| CVE-2020-23761 | subrion CMS Cross Site Scripting (XSS) vulnerability | medium | 6.1 | <=4.2.1 | – |
| CVE-2014-9120 | Subrion CMS Cross-site scripting in search | medium | 0.0 | <3.2.3 | 3.2.3 |
| CVE-2019-20389 | Subrion CMS XSS | medium | 6.1 | <=4.2.1 | – |
| CVE-2020-12467 | Session Fixation in Subrion CMS | medium | 6.5 | <=4.2.1 | – |
| CVE-2018-11317 | Subrion CMS XSS | medium | 6.1 | <4.1.4 | 4.1.4 |
| CVE-2020-12469 | Subrion CMS PHP Object Injection | medium | 6.5 | <=4.2.1 | – |
| CVE-2020-12468 | Subrion CMS CSV injection via Export Language | high | 7.8 | =4.2.1 | – |
| CVE-2023-43875 | Subrion CMS vulnerable to Cross-site Scripting | medium | 6.1 | <=4.2.1 | – |
| CVE-2018-14835 | Subrion CMS XSS | medium | 5.4 | <=4.2.1 | – |
| CVE-2018-15563 | Subrion CMS Stored Cross-site Scripting (XSS) | medium | 6.1 | <=4.2.1 | – |
| CVE-2019-20390 | Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability | high | 8.1 | =4.2.1 | – |
| CVE-2017-18366 | Subrion CMS vulnerable to CSRF in blog/delete | high | 8.8 | <4.2.1 | 4.2.1 |
| CVE-2020-22330 | Subrion Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | >=4.2.1 and <4.2.2 | 4.2.2 |
| CVE-2022-43121 | Subrion CMS is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | <=4.2.1 | – |
| CVE-2020-22392 | Cross Site Scripting in Subrion CMS | medium | 5.4 | <=4.2.1 | – |
| CVE-2018-16327 | Subrion Cross-site Scripting (XSS) | medium | 4.8 | =4.2.1 | – |
| CVE-2017-6068 | Subrion CMS vulnerable to CSRF in admin/blocks/add | high | 8.8 | <=4.0.5 | – |
| CVE-2023-43828 | Subrion CMS Cross-site Scripting vulnerability in /panel/languages | medium | 5.4 | <=4.2.1 | – |
| CVE-2023-43830 | Subrion CMS XSS in /panel/configuration/financial/ | medium | 5.4 | <=4.2.1 | – |
| CVE-2022-37059 | Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel | medium | 4.8 | <=4.2.1 | – |
| CVE-2018-16629 | Subrion CMS XSS | medium | 4.8 | <=4.2.1 | – |
| CVE-2021-41502 | Cross site scripting in intelliants/subrion | medium | 5.4 | <=4.2.1 | – |
| CVE-2022-43120 | Subrion CMS is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | <=4.2.1 | – |
| CVE-2017-15063 | Subrion CMS CSRF Vulnerability | high | 8.8 | >=4.1 and <4.2.0 | 4.2.0 |
| CVE-2018-21037 | Subrion CMS CSRF Vulnerability | high | 8.8 | <4.2.1 | 4.2.1 |
| CVE-2021-41948 | Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin | medium | 4.8 | <=4.2.1 | – |
| CVE-2023-43884 | Subrion CMS Cross-site Scripting vulnerability | medium | 5.4 | <=4.2.1 | – |
| CVE-2024-25399 | Subrion CMS vulnerable to Cross Site Scripting | medium | 6.1 | <=4.2.1 | – |
| CVE-2025-70958 | Subrion CMS vulnerable to cross-site scripting | medium | 6.1 | <=4.2.1 | – |
| CVE-2026-12202 | Subrion CMS vulnerable to Cross-site Scripting | low | 2.4 | <=4.0.3 | – |
| CVE-2025-56556 | Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool | medium | 6.5 | <=4.2.1 | – |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked