Schlix Cms vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Schlix Cms: 3 record(s), with affected versions and fixes.
cpe:2.3:a:schlix:cms

CVE-2021-47964 High · 8.8 CWE-94 May 15, 2026

Schlix CMS 2.2.6-6 Remote Code Execution via core.blockmanager

Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and trigger execution by accessing the About tab of the installed extension.

CVE-2021-47834 Medium · 6.4 CWE-79 Jan 16, 2026

Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)

Schlix CMS 2.2.6-6 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into category titles. Attackers can create a new contact category with a script payload that will execute when the page is viewed by other users.

CVE-2025-67443 Medium · 6.1 CWE-79 Dec 22, 2025

Cross-site Scripting (XSS) in Schlix Cms

Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sanitization in the login form, incorrect login attempts in logs are triggered as XSS in the admin panel.