Snewscms vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Snewscms products: 2 record(s), with severity, exploitation and fixes.

Snews 2 Snews CMS upload sheller 1 Snews CMS Cross Site Request Forgery 1

Exploited only (KEV) →

CVE-2016-20052 Critical · 9.8 CWE-434 Apr 4, 2026

Snews CMS 1.7 Unrestricted File Upload via snews_files

Snews CMS 1.7 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files including PHP executables to the snews_files directory. Attackers can upload malicious PHP files through the multipart form-data upload endpoint and execute them by accessing the uploaded file path to achieve remote code execution.

CVE-2016-20051 Medium · 4.3 CWE-352 Apr 4, 2026

Snews CMS 1.7 Cross-Site Request Forgery via changeup

Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that submits POST requests to the changeup action, modifying the admin username and password parameters to gain unauthorized access.