Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19 results
Sep 23, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-92692 · Other software · sulu · reported by GitHubMedium 6.9
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-82396 · Other software · sulu · reported by GitHubMedium 5.4
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-82395 · Other software · sulu · reported by GitHubMedium 5.3
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php allows MediaManager::move() to reassign the item without checking that source. An authenticated backend user with edit permission on one collection and knowledge of a target media identifier can name the allowed collection in the request, move an item out of a restricted collection, and then view or download content the user was not permitted to access. This issue is fixed in versions 2.6.25 and 3.0.8.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-82394 · Other software · sulu · reported by GitHubMedium 5.3
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in PreviewLinkManager::generate() or PreviewLinkManager::revoke(). An authenticated administration user who knows a target resource identifier can create or revoke a preview link for any page, article, or snippet, including content in a webspace or area the user cannot view. A generated preview URL is public and resolves content by an opaque token, allowing the user or anyone receiving the link to read restricted content without authentication. This issue is fixed in versions 2.6.25 and 3.0.8.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-45701 · Other software · sulu · reported by GitHubMedium 6.9
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.23 and 3.0.6, the password reset tokenand API key generation uses a weak cryptographical hash algorithm. This issue has been patched in versions 2.6.23 and 3.0.6.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-34372 · Other software · sulu · reported by GitHubMedium 5.3
Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user which has permission for the Sulu Admin via at least one role could have access to the sub-entities of contacts via the admin API without even have permission for contacts. This issue has been patched in versions 2.6.22 and 3.0.5.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2025-47778 · Other software · sulu · reported by GitHubMedium 6.1
Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024Sulu is a PHP content management system.CVE-2024-47618 · Other software · sulu · reported by GitHubMedium 5.1
Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers. This issue is fixed in 2.6.5.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024Sulu is a PHP content management system.CVE-2024-47617 · Other software · sulu · reported by GitHubMedium 6.1
Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024The SuluFormBundle adds support for creating dynamic forms in Sulu Admin.CVE-2024-37156 · Other software · sulu · reported by GitHubMedium 6.1
The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3.
- Product
- SuluFormBundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Sulu is a PHP content management system.CVE-2024-27915 · Other software · sulu · reported by GitHubMedium 6.8
Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024Sulu is a highly extensible open-source PHP content management system based on the Symfony framework.CVE-2024-24807 · Other software · sulu · reported by GitHubLow 2.7
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones affected. The problem is patched with version(s) 2.4.16 and 2.5.12.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2023-39343 · Other software · sulu · reported by GitHubMedium 4.3
Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by this Security issue. The vulnerability has been patched in version 2.5.10.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2021-43836 · Other software · sulu · reported by GitHubHigh 8.5
Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2021-43835 · Other software · sulu · reported by GitHubHigh 7.2
Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction. The versions have been patched in 2.2.18, 2.3.8 and 2.4.0. For users unable to upgrade the only known workaround is to apply a patch to the ProfileController manually.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2021Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2021-41169 · Other software · sulu · reported by GitHubMedium 6.2
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2021-32737 · Other software · sulu · reported by GitHubHigh 8.4
Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2020In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email adCVE-2020-15132 · Other software · sulu · reported by GitHubMedium 5.3
In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that this user name does not exist. This enables attackers to retrieve valid usernames. Also, the response of the "Forgot Password" request returns the email address to which the email was sent, if the operation was successful. This information should not be exposed, as it can be used to gather email addresses. This problem was fixed in versions 1.6.35, 2.0.10 and 2.1.1.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2018Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in disruption of serviceCVE-2017-1000465 · Other software · Sulu · reported by MITREMedium 5.4
Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in disruption of service and execution of javascript code.
- Product
- Sulu-standard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.