Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
89 results · page 1 of 2
Oct 7, 2026A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or CVE-2026-96408 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpCritical 9.3
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
- Product
- Movable Type Cloud Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL queryCVE-2026-103668 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpHigh 8.8
An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.
- Product
- Movable Type Cloud Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Missing authorization vulnerability exists in Movable Type.CVE-2026-44392 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 5.3
Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Movable Type provided by Six Apart Ltd.CVE-2026-33088 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.9
Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Movable Type provided by Six Apart Ltd.CVE-2026-25776 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpCritical 9.3
Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data.CVE-2026-24447 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 4.8
If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
- Product
- Movable Type (Software Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026A non-administrative user can upload malicious files.CVE-2026-23704 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 5.1
A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
- Product
- Movable Type (Software Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Movable Type contains a stored cross-site scripting vulnerability in Export Sites.CVE-2026-22875 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 4.8
Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
- Product
- Movable Type (Software Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Movable Type contains a stored cross-site scripting vulnerability in Edit Comment.CVE-2026-21393 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 4.8
Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
- Product
- Movable Type (Software Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page.CVE-2025-62499 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 4.6
Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page.
- Product
- Movable Type (Software Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page.CVE-2025-54856 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 4.6
Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.
- Product
- Movable Type (Software Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type.CVE-2025-55706 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 5.1
URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.
- Product
- Movable Type (Software Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Movable Type contains an issue with use of less trusted source.CVE-2025-53522 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.9
Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.
- Product
- Movable Type (Software Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page.CVE-2025-25054 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.
- Product
- Movable Type (8.4.x series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor.CVE-2025-24841 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 5.4
Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.
- Product
- Movable Type (8.4.x series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor.CVE-2025-22888 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 5.4
Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user's web browser.
- Product
- Movable Type (8.4.x series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script.CVE-2023-45746 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier.
- Product
- Movable Type 7 (Movable Type 7 Series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (MovablCVE-2022-45122 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type 6.8.7 and earlier (Movable Type 6 Series), Movable Type Advanced 6.8.7 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022Improper validation of syntactic correctness of input vulnerability exist in Movable Type series.CVE-2022-45113 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.5
Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a remote unauthenticated attacker to set a specially crafted URL to the Reset Password page and conduct a phishing attack. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type 6.8.7 and earlier (Movable Type 6 Series), Movable Type Advanced 6.8.7 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage CVE-2022-43660 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpHigh 7.2
Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2022Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable TyCVE-2022-38972 · Other software · ARK-Web co., ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable Type 6 Series) allows a remote unauthenticated attacker to inject an arbitrary script.
- Product
- A-Form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2022Movable Type XMLRPC API provided by Six Apart Ltd.CVE-2022-38078 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and versions are as follows: Movable Type 7 r.5202 and earlier, Movable Type Advanced 7 r.5202 and earlier, Movable Type 6.8.6 and earlier, Movable Type Advanced 6.8.6 and earlier, Movable Type Premium 1.52 and earlier, and Movable Type Premium Advanced 1.52 and earlier. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.
- Product
- Movable Type XMLRPC API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote authCVE-2020-5669 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (MCVE-2021-20837 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Aug 25, 2021Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 andCVE-2021-20815 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7CVE-2021-20814 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), and Movable Type Premium 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) and Movable Type AdCVE-2021-20813 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) and Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series)) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series)CVE-2021-20812 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and eCVE-2021-20811 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 aCVE-2021-20810 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series)CVE-2021-20809 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (CVE-2021-20808 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2021Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced CVE-2021-20665 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2021Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 CVE-2021-20664 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2021Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4CVE-2021-20663 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), MCVE-2020-5577 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpHigh 8.8
Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5), Movable Type 6.3.11 and earlier (Movable Type 6.3), Movable Type Advanced 6.3.11 and earlier (Movable Type 6.3), Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier) allow remote authenticated attackers to upload arbitrary files and execute a php script via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.46CVE-2020-5576 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5), Movable Type 6.3.11 and earlier (Movable Type 6.3), Movable Type Advanced 6.3.11 and earlier (Movable Type 6.3), Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier) allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) anCVE-2020-5575 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5), Movable Type 6.3.11 and earlier (Movable Type 6.3), Movable Type Advanced 6.3.11 and earlier (Movable Type 6.3), Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 CVE-2020-5574 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 5.3
HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5), Movable Type 6.3.11 and earlier (Movable Type 6.3), Movable Type Advanced 6.3.11 and earlier (Movable Type 6.3), Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier) allows remote attackers to inject arbitrary HTML attribute value via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2020Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5)CVE-2020-5528 · Other software · Six Apart Ltd · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type Advanced 7), Movable Type Advanced 6.5.2 and earlier (Movable Type Advanced 6.5), Movable Type Premium 1.26 and earlier (Movable Type Premium), and Movable Type Premium Advanced 1.26 and earlier (Movable Type Premium Advanced)) allows remote attackers to inject arbitrary web script or HTML in the block editor and the rich text editor via a specially crafted URL.
- Product
- Movable Type series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2019Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 (Movable Type 6.5), CVE-2019-6025 · Other software · Six Apart Ltd · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type 6.3.9 and earlier (Movable Type 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Advanced 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type Advanced 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type Advanced 6.3.9 and earlier (Movable Type 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Premium 1.24 and earlier (Movable Type Premium), and Movable Type Premium (Advanced Edition) 1.24 and earlier (Movable Type Premium) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
- Product
- Movable Type series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018Cross-site scripting vulnerability in Movable Type versions prior to Ver.CVE-2018-0672 · Other software · Six Apart, Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2017SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.1CVE-2016-5742 · Other software · Sixapart · reported by MITRECritical 9.8
SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Apr 17, 2015Format string vulnerability in Movable Type Pro, Open Source, and Advanced before 5.2.13 and Pro and Advanced 6.0.x before 6.0.8 allows remote attackers to execCVE-2015-0845 · Other software · Sixapart · reported by security@debian.orgHigh 7.5
Format string vulnerability in Movable Type Pro, Open Source, and Advanced before 5.2.13 and Pro and Advanced 6.0.x before 6.0.8 allows remote attackers to execute arbitrary code via vectors related to localization of templates.
- Product
- Movabletype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecuritytracker.com
Mar 27, 2015Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state paramCVE-2013-2184 · Other software · Sixapart · reported by Red HatHigh 7.5
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Feb 19, 2015Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which CVE-2015-1592 · Other software · Debian · reported by MITREHigh 7.5
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Dec 16, 2014SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute aCVE-2014-9057 · Other software · Debian · reported by MITREHigh 7.5
SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.commovabletype.org
Sep 10, 2014Cross-site scripting (XSS) vulnerability in the management page in Six Apart Movable Type before 5.2 allows remote authenticated users to inject arbitrary web sCVE-2014-5313 · Other software · Sixapart · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in the management page in Six Apart Movable Type before 5.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Movabletype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2014Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script CVE-2012-1503 · Other software · Sixapart · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org
Jan 10, 2014Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remoCVE-2014-0977 · Other software · Sixapart · reported by security@debian.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Movabletype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgmovabletype.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.