Plone vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-57149 plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone.Critical 9.9 · Sep 22, 2026
• CVE-2026-55248 plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets.Critical 9.1 · Aug 28, 2026
• CVE-2026-55247 plone.app.event provides the event content type for Plone.Critical 9.1 · Aug 28, 2026
• CVE-2025-61668 Volto is a ReactJS-based frontend for the Plone Content Management System.High 8.7 · Oct 2, 2025
• CVE-2025-58047 Volto is a React based frontend for the Plone Content Management System.High 7.5 · Aug 28, 2025
• CVE-2024-22889 Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.High 7.5 · Mar 5, 2024
• CVE-2024-23756 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions High 7.5 · Feb 8, 2024
• CVE-2024-23054 An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++staticCritical 9.8 · Feb 5, 2024
• CVE-2023-42457 plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc.High 7.5 · Sep 21, 2023
• CVE-2021-33926 An issue in Plone CMS v.High 8.8 · Feb 17, 2023
• CVE-2021-33511 Plone though 5.2.4 allows SSRF via the lxml parser.High 7.5 · May 21, 2021
• CVE-2021-33509 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.Critical 9.9 · May 21, 2021
• CVE-2020-28736 Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only availableHigh 8.8 · Dec 30, 2020
• CVE-2020-28735 Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).High 8.8 · Dec 30, 2020
• CVE-2020-28734 Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.High 8.8 · Dec 30, 2020
• CVE-2020-35190 The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user.Critical 9.8 · Dec 16, 2020
• CVE-2020-7941 A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.Critical 9.8 · Jan 23, 2020
• CVE-2020-7940 Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.High 7.5 · Jan 23, 2020
• CVE-2020-7939 SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries.High 8.8 · Jan 23, 2020
• CVE-2020-7938 plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.High 8.8 · Jan 23, 2020
• CVE-2015-7293 Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.High 8.8 · Sep 25, 2017
• CVE-2015-7318 Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.High 7.5 · Sep 25, 2017
• CVE-2016-4041 Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access vHigh 7.3 · Feb 24, 2017
• CVE-2012-5493 gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrarHigh 8.5 · Sep 30, 2014
• CVE-2012-5487 The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypaHigh 8.5 · Sep 30, 2014