The Elefant CMS
58%
Total Score
50
81
100
Only two releases exist, with none in the last 12 months; the latest was about 23 months ago and the median release interval is about 2 years 8 months. This indicates materially slow maintenance.
The repository recorded zero commits and zero active maintainers in the last 3 months. This reinforces the release-history evidence of currently inactive maintenance.
There were no new or closed issues and no merged pull requests in the last month, while 29 issues and 6 pull requests remain open. This suggests limited current project response.
The project uses Make and Composer, but no repository security-scanning tools were detected. For a CMS with a substantial application codebase, that is a meaningful hygiene gap.
The assessed version is marked prerelease, and all recent releases are prereleases despite being on a stable major line. That weakens release maturity and predictability.
| Title | Versions | Severity |
|---|---|---|
CVE-2017-20064 elefant/cms is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 1.3.13. | 0.0.0 - 1.3.13 | High |
CVE-2017-20061 elefant/cms is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.3.13. | 0.0.0 - 1.3.13 | Medium |
CVE-2017-20060 elefant/cms is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.3.13. | 0.0.0 - 1.3.13 | Medium |
CVE-2017-20062 elefant/cms is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.0.0 - 1.3.13. | 0.0.0 - 1.3.13 | High |
CVE-2017-20057 elefant/cms is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.3.13. | 0.0.0 - 1.3.13 | Medium |
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
pda/pheanstalk Version ^4.0 | — | — |
google/apiclient Version ^2.12.1 | — | — |
chillerlan/php-qrcode Version ^4.3 | — | — |
pragmarx/google2fa-qrcode Version ^3.0 | — | — |
bshaffer/oauth2-server-php Version ^1.10 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.