CVE-2024-31213: low-severity vulnerability in instantsoft icms2
InstantCMS Open Redirect vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.5epss 0.4%
InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected products
instantsoft · icms2Related CVEs — instantsoft icms2
In the same product, most dangerous first.
CVE-2024-31212MEDIUMSQL injection in index_chart_data actionEPSS 0.9%CVE-2026-54611MEDIUMInstantCMS has Remote Code Execution in package installerEPSS 0.7%CVE-2025-59055MEDIUMInstantCMS vulnerable to Server-Side Request Forgery via package installerEPSS 0.5%CVE-2024-50348MEDIUMInstantCMS has a Cross Site Scripting VulnerabilityEPSS 0.3%CVE-2026-48707LOWInstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanningEPSS 0.3%CVE-2026-28281HIGHInstantCMS has Multiple CSRF VulnerabilitiesEPSS 0.2%