Saurus

    Dashboard / Vendors

    Products: 2
    Vulnerabilities: 7
    Known Exploited: 0
    2
    Critical Level Threats
    1
    High Level Threats
    3
    Medium Level Threats
    1
    Low Level Threats

    Vulnerabilities

    100806040200
    JanFebMarAprMayJunJulAugSepOctNovDec
    Critical Level Threats
    High Level Threats
    Medium Level Threats
    Low Level Threats

    Products Security index

    Actions
    Items Per Page

    Vulnerabilities

    CVE-2026-73671

    Saurus CMS Unauthenticated Open Redirect via logout url parameter

    Last Modified: Aug 14, 2026
    Published: Aug 13, 2026

    CVE-2026-73670

    CMS Admin SQL Injection via db_data.php table_name Parameter

    Last Modified: Aug 14, 2026
    Published: Aug 13, 2026

    CVE-2025-50567

    Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code execution.

    Last Modified: Apr 15, 2026
    Published: Aug 19, 2025

    CVE-2025-52390

    Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()` method in `FulltextSearch.class.php`. The application directly concatenates user-supplied input (`$search_word`) into SQL queries without sanitization, allowing attackers to manipulate the SQL logic and potentially extract sensitive information or escalate their privileges.

    Last Modified: Apr 15, 2026
    Published: Aug 01, 2025

    CVE-2015-0876

    Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Last Modified: Apr 12, 2025
    Published: Apr 07, 2015
    Items Per Page