silverstripe/cms

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in S…

code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.

vulnerable: 2.4.10 ... 3.1.9-rc1 (61 versions)

Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build.

vulnerable: 3.2.0, 3.2.1-rc1, 3.2.1-rc2

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to …

vulnerable: 3.6.0 ... 3.6.1-alpha2 (6 versions)

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.

vulnerable: 2.4.10 ... 3.6.1-alpha2 (154 versions)

SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/As…

vulnerable: 3.5.0, 3.5.1, 3.5.1-rc1, 3.5.1-rc2, 3.5.2-rc1

There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element.

vulnerable: 4.4.0, 4.4.1, 4.4.2, 4.4.3

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.

vulnerable: 2.4.10 ... 4.5.0-rc2 (226 versions)

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific…

vulnerable: 2.4.10 ... 4.5.0-rc2 (226 versions)

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions (for example HTML code in a TXT file). When these files are stored as protected or draft files, the MIME detec…

vulnerable: 2.4.10 ... 4.5.0-rc2 (226 versions)

In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs.

vulnerable: 4.0.0 ... 4.9.2 (72 versions)

Silverstripe silverstripe/cms through 4.11.0 allows XSS.