Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
120 results · page 1 of 3
Sep 22, 2026plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types.CVE-2026-57576 · Other software · plone · reported by GitHubMedium 6.5
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.
- Product
- plone.app.dexterity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone.CVE-2026-57149 · Other software · plone · reported by GitHubCritical 9.9
plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code. This is exploitable by any authenticated user who can configure a Classic portlet - which, with the default role map, includes regular users on their personal dashboard. The result is code execution in the context of the Plone process, i.e. a privilege escalation across the trust boundary between an authenticated web user and the server-side process. The problem has been patched in `plone.app.portlets` 5.0.8, 6.0.4, and 7.0.2. Some workarounds are available. Restrict who can manage portlets: remove the `plone.app.portlets.ManageOwnPortlets` permission from untrusted roles, and
- Product
- plone.app.portlets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type.CVE-2026-54503 · Other software · plone · reported by GitHubMedium 4.3
plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.
- Product
- plone.app.textfield
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets.CVE-2026-55248 · Other software · plone · reported by GitHubCritical 9.1
plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.
- Product
- plone.app.portlets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026plone.app.event provides the event content type for Plone.CVE-2026-55247 · Other software · plone · reported by GitHubCritical 9.1
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per event. A logged-in editor can make the server request internal network resources or local calendar files, exhaust resources and take the site offline, and store a malicious event URL that executes script in another user's browser. The fix restricts accepted URLs, applies MAXIMUM_ICAL_IMPORT_SIZE_BYTES and MAXIMUM_ICAL_IMPORT_EVENTS limits, uses transaction savepoints, and validates event URLs. This issue is fixed in versions 5.2.4 and 6.0.1.
- Product
- plone.app.event
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Products.isurlinportal is a replacement for isURLInPortal method in Plone.CVE-2026-28413 · Other software · plone · reported by GitHubMedium 5.3
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0.
- Product
- Products.isurlinportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Volto is a ReactJS-based frontend for the Plone Content Management System.CVE-2025-61668 · Other software · plone · reported by GitHubHigh 8.7
Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.
- Product
- volto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025Volto is a React based frontend for the Plone Content Management System.CVE-2025-58047 · Other software · plone · reported by GitHubHigh 7.5
Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. The problem has been patched in versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha.4. To mitigate downtime, have setup automatically restart processes that quit with an error.
- Product
- volto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2024Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.CVE-2024-22889 · Other software · Plone · reported by MITREHigh 7.5
Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions CVE-2024-23756 · Other software · Plone · reported by MITREHigh 7.5
The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++staticCVE-2024-23054 · Other software · plone · reported by MITRECritical 9.8
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index (npm).
- Product
- plone_docker_official_image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headersCVE-2024-23055 · Other software · Plone · reported by MITREMedium 6.1
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headers.
- Product
- Plone Docker Official Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5.CVE-2024-0669 · Other software · Plone CMS · reported by cve-coordination@incibe.esMedium 6.3
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.
- Product
- Plone CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc.CVE-2023-42457 · Other software · plone · reported by GitHubHigh 7.5
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).
- Product
- plone.rest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Sep 21, 2023plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content.CVE-2023-41048 · Other software · plone · reported by GitHubLow 3.7
plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in versions 5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone 6.0.7). There are no known workarounds.
- Product
- plone.namedfile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Feb 17, 2023An issue in Plone CMS v.CVE-2021-33926 · Other software · Plone · reported by MITREHigh 8.8
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Volto is a ReactJS-based frontend for the Plone Content Management System.CVE-2022-24740 · Other software · plone · reported by GitHubMedium 5
Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and privileges. This occurs when using an outdated version of the `react-cookie` library and a server is under high load. A proof of concept does not currently exist, but it is possible for this issue to occur in the wild. The patch and fix is present in Volto 15.0.0-alpha.0. As a workaround, one may manually upgrade the `react-cookie` package to 4.1.1 and then override all Volto components that use this library.
- Product
- volto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Products.ATContentTypes are the core content types for Plone 2.1 - 4.3.CVE-2022-23599 · Other software · Plone · reported by GitHubMedium 4.3
Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user's cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2021Products.isurlinportal is a replacement for isURLInPortal method in Plone.CVE-2021-32806 · Other software · plone · reported by GitHubMedium 6.5
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like `https://example.org` is not in the portal. The url `https:example.org` without slashes is considered to be in the portal. When redirecting, some browsers go to `https://example.org`, others give an error. Attackers may use this to redirect victims to their site, especially as part of a phishing attack. The problem has been patched in Products.isurlinportal 1.2.0.
- Product
- Products.isurlinportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2021In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the descriptioCVE-2021-35959 · Other software · Plone · reported by MITREMedium 5.4
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.CVE-2021-33513 · Other software · Plone · reported by MITREMedium 5.4
Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.CVE-2021-33512 · Other software · Plone · reported by MITREMedium 5.4
Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021Plone though 5.2.4 allows SSRF via the lxml parser.CVE-2021-33511 · Other software · Plone · reported by MITREHigh 7.5
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.CVE-2021-33510 · Other software · Plone · reported by MITREMedium 4.3
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.CVE-2021-33509 · Other software · Plone · reported by MITRECritical 9.9
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.CVE-2021-33508 · Other software · Plone · reported by MITREMedium 5.4
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.CVE-2021-33507 · Other software · Plone · reported by MITREMedium 6.1
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2021Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality.CVE-2021-3313 · Other software · Plone · reported by MITREMedium 5.4
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2021A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter.CVE-2021-29002 · Other software · Plone · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 30, 2020Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only availableCVE-2020-28736 · Other software · Plone · reported by MITREHigh 8.8
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddist.plone.orggithub.com
Dec 30, 2020Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).CVE-2020-28735 · Other software · Plone · reported by MITREHigh 8.8
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddist.plone.orggithub.com
Dec 30, 2020Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.CVE-2020-28734 · Other software · Plone · reported by MITREHigh 8.8
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddist.plone.orggithub.com
Dec 16, 2020The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35190 · Other software · Plone · reported by MITRECritical 9.8
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2020A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.CVE-2020-7941 · Other software · Plone · reported by MITRECritical 9.8
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2020Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.CVE-2020-7940 · Other software · Plone · reported by MITREHigh 7.5
Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2020SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries.CVE-2020-7939 · Other software · Plone · reported by MITREHigh 8.8
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2020plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.CVE-2020-7938 · Other software · Plone · reported by MITREHigh 8.8
plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2020An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other useCVE-2020-7937 · Other software · Plone · reported by MITREMedium 5.4
An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2020An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followedCVE-2020-7936 · Other software · Plone · reported by MITREMedium 6.1
An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2020Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7CVE-2013-7062 · Other software · Plone · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 3, 2018By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website.CVE-2017-1000484 · Other software · Plone · reported by MITREMedium 6.1
By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2018Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1.CVE-2017-1000483 · Other software · Plone · reported by MITREMedium 6.5
Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2018A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page lCVE-2017-1000482 · Other software · Plone · reported by MITREMedium 5.4
A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2018When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url.CVE-2017-1000481 · Other software · Plone · reported by MITREMedium 6.1
When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2017Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.CVE-2015-7293 · Other software · Plone · reported by cret@cert.orgHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.complone.org
Sep 25, 2017Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.CVE-2015-7318 · Other software · Plone · reported by MITREHigh 7.5
Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Sep 25, 2017Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5CVE-2015-7316 · Other software · Plone · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Sep 25, 2017Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new CVE-2015-7315 · Other software · Plone · reported by MITREMedium 5.9
Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Mar 23, 2017Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging thCVE-2017-5524 · Other software · Plone · reported by MITREMedium 4.3
Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Mar 7, 2017Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow rCVE-2016-7140 · Other software · Plone · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.