Silverstripe/cms

This hub aggregates every CVE we track for Silverstripe/cms, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 12 most recently published vulnerabilities affecting Silverstripe/cms.

• CVE-2022-37421Silverstripe silverstripe/cms through 4.11.0 allows XSS.5.4Nov 23, 2022
• CVE-2020-9311In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted l...5.4Jul 15, 2020
• CVE-2020-9309Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions (for example HTML code in a TXT file). When these files are stored a...8.8Jul 15, 2020
• CVE-2020-6164In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe applicati...7.5Jul 15, 2020
• CVE-2019-12204In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.9.8Sep 25, 2019
• CVE-2017-12849Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.5.3Oct 12, 2017
• CVE-2017-14498SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/p...6.1Sep 15, 2017
• CVE-2017-5197There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element.6.1Mar 6, 2017
• CVE-2015-8606Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Lo...6.1Apr 13, 2016
• CVE-2015-5062Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter...5.8Jun 24, 2015
• CVE-2011-4962code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not ...6.8Sep 17, 2012
• CVE-2010-1593Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm,...4.3Apr 28, 2010