CVE-2023-4654: Instantcms

Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

Affected products

• Instantcms Instantcms: before 2.16.1 (fixed in 2.16.1)

Published 2023-08-31. Last modified 2026-06-17.