engineercms vulnerabilities

CVEs whose affected-version data names the engineercms package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111652Medium· 5.3PoC

2d ago

Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attach…

▾ Twilight3xxx · engineercmsEPSS 0.39%via CVEORG