Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/silverstripe/framework@3.2.4
Typecomposer
Namespacesilverstripe
Nameframework
Version3.2.4
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.3.23
Latest_non_vulnerable_version6.0.0-alpha1
Affected_by_vulnerabilities
0
url VCID-11sx-j3x7-gkcr
vulnerability_id VCID-11sx-j3x7-gkcr
summary 
Reflected Cross Site Scripting (XSS) in error message
If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2024-002.yaml
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2024-002.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://www.silverstripe.org/download/security-releases/ss-2024-002
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2024-002
3
reference_url https://github.com/advisories/GHSA-74j9-xhqr-6qv3
reference_id GHSA-74j9-xhqr-6qv3
reference_type
scores
url https://github.com/advisories/GHSA-74j9-xhqr-6qv3
fixed_packages
0
url pkg:composer/silverstripe/framework@5.3.8
purl pkg:composer/silverstripe/framework@5.3.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2hk2-hzyh-wbhf
1
vulnerability VCID-79qx-v5uu-jyf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@5.3.8
aliases GHSA-74j9-xhqr-6qv3
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-11sx-j3x7-gkcr
1
url VCID-1mmc-91gk-r3d3
vulnerability_id VCID-1mmc-91gk-r3d3
summary SilverStripe allowss Reflected SQL Injection through Form and `DataObject`.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-5715
reference_id
reference_type
scores
0
value 0.00322
scoring_system epss
scoring_elements 0.55605
published_at 2026-06-05T12:55:00Z
1
value 0.00322
scoring_system epss
scoring_elements 0.55549
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-5715
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-5715.yaml
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-5715.yaml
2
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
3
reference_url https://github.com/silverstripe/silverstripe-framework/issues/8814
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/issues/8814
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-5715
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-5715
5
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
6
reference_url https://www.silverstripe.org/download/security-releases/ss-2018-021
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2018-021
fixed_packages
0
url pkg:composer/silverstripe/framework@3.6.7
purl pkg:composer/silverstripe/framework@3.6.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-pkve-yjqy-syc2
19
vulnerability VCID-qmfy-dxag-uuex
20
vulnerability VCID-r1eg-dwej-5kau
21
vulnerability VCID-tv7h-289s-xub4
22
vulnerability VCID-u9e7-1zhg-mygt
23
vulnerability VCID-umhc-fdfh-1fdx
24
vulnerability VCID-uy47-3s8a-hbdn
25
vulnerability VCID-wgdv-etcq-3qhw
26
vulnerability VCID-xg74-3h1h-kqaf
27
vulnerability VCID-y8et-m846-2fc6
28
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.6.7
1
url pkg:composer/silverstripe/framework@3.7.3
purl pkg:composer/silverstripe/framework@3.7.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-pkve-yjqy-syc2
19
vulnerability VCID-qmfy-dxag-uuex
20
vulnerability VCID-r1eg-dwej-5kau
21
vulnerability VCID-tv7h-289s-xub4
22
vulnerability VCID-umhc-fdfh-1fdx
23
vulnerability VCID-uy47-3s8a-hbdn
24
vulnerability VCID-wgdv-etcq-3qhw
25
vulnerability VCID-xg74-3h1h-kqaf
26
vulnerability VCID-y8et-m846-2fc6
27
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.7.3
2
url pkg:composer/silverstripe/framework@4.0.7
purl pkg:composer/silverstripe/framework@4.0.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-ca4q-xd4v-vqfe
15
vulnerability VCID-cmwn-cjff-9qau
16
vulnerability VCID-fmfu-81xu-pfdy
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-n4fk-735u-2baw
22
vulnerability VCID-nute-ndg2-z7ev
23
vulnerability VCID-nzcm-xbxx-wyf9
24
vulnerability VCID-pkve-yjqy-syc2
25
vulnerability VCID-qmfy-dxag-uuex
26
vulnerability VCID-r1eg-dwej-5kau
27
vulnerability VCID-ru3j-21j8-ayhm
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-uy47-3s8a-hbdn
30
vulnerability VCID-wgdv-etcq-3qhw
31
vulnerability VCID-xg74-3h1h-kqaf
32
vulnerability VCID-xm4q-u96p-57dd
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-ytbc-8mhd-b3fc
35
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.7
3
url pkg:composer/silverstripe/framework@4.1.5
purl pkg:composer/silverstripe/framework@4.1.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-ca4q-xd4v-vqfe
15
vulnerability VCID-cmwn-cjff-9qau
16
vulnerability VCID-fmfu-81xu-pfdy
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-n4fk-735u-2baw
22
vulnerability VCID-nute-ndg2-z7ev
23
vulnerability VCID-nzcm-xbxx-wyf9
24
vulnerability VCID-pkve-yjqy-syc2
25
vulnerability VCID-qmfy-dxag-uuex
26
vulnerability VCID-r1eg-dwej-5kau
27
vulnerability VCID-ru3j-21j8-ayhm
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-uy47-3s8a-hbdn
30
vulnerability VCID-wgdv-etcq-3qhw
31
vulnerability VCID-xg74-3h1h-kqaf
32
vulnerability VCID-xm4q-u96p-57dd
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-ytbc-8mhd-b3fc
35
vulnerability VCID-z94y-nz4f-y7er
36
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.1.5
4
url pkg:composer/silverstripe/framework@4.2.4
purl pkg:composer/silverstripe/framework@4.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-ca4q-xd4v-vqfe
15
vulnerability VCID-cmwn-cjff-9qau
16
vulnerability VCID-fmfu-81xu-pfdy
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-n4fk-735u-2baw
22
vulnerability VCID-nute-ndg2-z7ev
23
vulnerability VCID-nzcm-xbxx-wyf9
24
vulnerability VCID-pkve-yjqy-syc2
25
vulnerability VCID-qmfy-dxag-uuex
26
vulnerability VCID-r1eg-dwej-5kau
27
vulnerability VCID-ru3j-21j8-ayhm
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-uy47-3s8a-hbdn
30
vulnerability VCID-wgdv-etcq-3qhw
31
vulnerability VCID-xg74-3h1h-kqaf
32
vulnerability VCID-xm4q-u96p-57dd
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-ytbc-8mhd-b3fc
35
vulnerability VCID-z94y-nz4f-y7er
36
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.2.4
5
url pkg:composer/silverstripe/framework@4.3.1
purl pkg:composer/silverstripe/framework@4.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-ca4q-xd4v-vqfe
15
vulnerability VCID-cmwn-cjff-9qau
16
vulnerability VCID-fmfu-81xu-pfdy
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-n4fk-735u-2baw
22
vulnerability VCID-nute-ndg2-z7ev
23
vulnerability VCID-nzcm-xbxx-wyf9
24
vulnerability VCID-pkve-yjqy-syc2
25
vulnerability VCID-qmfy-dxag-uuex
26
vulnerability VCID-r1eg-dwej-5kau
27
vulnerability VCID-ru3j-21j8-ayhm
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-uy47-3s8a-hbdn
30
vulnerability VCID-wgdv-etcq-3qhw
31
vulnerability VCID-xg74-3h1h-kqaf
32
vulnerability VCID-xm4q-u96p-57dd
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-ytbc-8mhd-b3fc
35
vulnerability VCID-z94y-nz4f-y7er
36
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.1
aliases CVE-2019-5715, GHSA-wvfw-w3x6-g526
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1mmc-91gk-r3d3
2
url VCID-1p79-328x-sueq
vulnerability_id VCID-1p79-328x-sueq
summary 
Quadratic blowup in Convert::xml2array()
Silverstripe silverstripe/framework 4.x until 4.10.9 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-41559
reference_id
reference_type
scores
0
value 0.00348
scoring_system epss
scoring_elements 0.57671
published_at 2026-06-05T12:55:00Z
1
value 0.00348
scoring_system epss
scoring_elements 0.57619
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-41559
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2021-41559.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2021-41559.yaml
2
reference_url https://github.com/silverstripe/silverstripe-framework/releases
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/releases
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-41559
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-41559
4
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
5
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
6
reference_url https://www.silverstripe.org/download/security-releases/cve-2021-41559
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2021-41559
7
reference_url https://github.com/advisories/GHSA-9fmg-89fx-r33w
reference_id GHSA-9fmg-89fx-r33w
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-9fmg-89fx-r33w
fixed_packages
0
url pkg:composer/silverstripe/framework@4.10.9
purl pkg:composer/silverstripe/framework@4.10.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7gak-15m5-j3f5
5
vulnerability VCID-7w7t-3783-1kbs
6
vulnerability VCID-86vg-4j71-hkgr
7
vulnerability VCID-8u5c-6vx3-mfcr
8
vulnerability VCID-9t4k-8hsz-bfdw
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-ca4q-xd4v-vqfe
12
vulnerability VCID-gnpw-s9hp-wqfs
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-uy47-3s8a-hbdn
16
vulnerability VCID-xm4q-u96p-57dd
17
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.10.9
1
url pkg:composer/silverstripe/framework@4.11.0-beta1
purl pkg:composer/silverstripe/framework@4.11.0-beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7w7t-3783-1kbs
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9t4k-8hsz-bfdw
8
vulnerability VCID-9y5u-qyzd-3ud9
9
vulnerability VCID-a7cf-kpzy-xudd
10
vulnerability VCID-ca4q-xd4v-vqfe
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-k46z-g6jp-57ek
13
vulnerability VCID-ky21-z2d2-sye6
14
vulnerability VCID-uy47-3s8a-hbdn
15
vulnerability VCID-xm4q-u96p-57dd
16
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.11.0-beta1
aliases CVE-2021-41559, GHSA-9fmg-89fx-r33w
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1p79-328x-sueq
3
url VCID-36z3-nafq-6kez
vulnerability_id VCID-36z3-nafq-6kez
summary 
XSS In CMSSecurity BackURL
In follow up to SS-2016-001 there is yet a minor unresolved fix to incorrectly encoded URL.
references
0
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-001/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2016-001/
1
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-016/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2016-016/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.6
purl pkg:composer/silverstripe/framework@3.2.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3x46-q9cb-7ubg
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-b6nm-cphj-wfgw
12
vulnerability VCID-b95v-49p7-fkas
13
vulnerability VCID-c6bz-jwhm-vkgp
14
vulnerability VCID-cmwn-cjff-9qau
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-mkex-ht2r-cucz
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-nute-ndg2-z7ev
22
vulnerability VCID-pkve-yjqy-syc2
23
vulnerability VCID-qdwg-f2bx-1bay
24
vulnerability VCID-qmfy-dxag-uuex
25
vulnerability VCID-r1eg-dwej-5kau
26
vulnerability VCID-sg62-98yy-2kd7
27
vulnerability VCID-t81f-5b8z-hyht
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-umhc-fdfh-1fdx
30
vulnerability VCID-uy47-3s8a-hbdn
31
vulnerability VCID-wgdv-etcq-3qhw
32
vulnerability VCID-xg74-3h1h-kqaf
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.6
1
url pkg:composer/silverstripe/framework@3.3.4
purl pkg:composer/silverstripe/framework@3.3.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3x46-q9cb-7ubg
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-b6nm-cphj-wfgw
12
vulnerability VCID-b95v-49p7-fkas
13
vulnerability VCID-c6bz-jwhm-vkgp
14
vulnerability VCID-cmwn-cjff-9qau
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-mkex-ht2r-cucz
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-nute-ndg2-z7ev
22
vulnerability VCID-pkve-yjqy-syc2
23
vulnerability VCID-qdwg-f2bx-1bay
24
vulnerability VCID-qmfy-dxag-uuex
25
vulnerability VCID-r1eg-dwej-5kau
26
vulnerability VCID-sg62-98yy-2kd7
27
vulnerability VCID-t81f-5b8z-hyht
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-umhc-fdfh-1fdx
30
vulnerability VCID-uy47-3s8a-hbdn
31
vulnerability VCID-wgdv-etcq-3qhw
32
vulnerability VCID-xg74-3h1h-kqaf
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.4
2
url pkg:composer/silverstripe/framework@3.4.2
purl pkg:composer/silverstripe/framework@3.4.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3j6f-5c14-uubc
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4qjj-wqg5-dbay
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7hxq-cp29-r7dh
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-bwrh-updj-zkfs
16
vulnerability VCID-c6bz-jwhm-vkgp
17
vulnerability VCID-cmwn-cjff-9qau
18
vulnerability VCID-gnpw-s9hp-wqfs
19
vulnerability VCID-hcuz-gz3w-97ew
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-njph-ua7r-auaq
25
vulnerability VCID-nute-ndg2-z7ev
26
vulnerability VCID-pkve-yjqy-syc2
27
vulnerability VCID-qdwg-f2bx-1bay
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.2
aliases SS-2016-016
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-36z3-nafq-6kez
4
url VCID-3x46-q9cb-7ubg
vulnerability_id VCID-3x46-q9cb-7ubg
summary 
Information Exposure
Response discrepancy in the login and password reset forms in SilverStripe CMS allows remote attackers to enumerate users via timing attack.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-12849
reference_id
reference_type
scores
0
value 0.00392
scoring_system epss
scoring_elements 0.60505
published_at 2026-06-04T12:55:00Z
1
value 0.00392
scoring_system epss
scoring_elements 0.60553
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-12849
1
reference_url https://www.silverstripe.org/download/security-releases/ss-2017-005
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2017-005
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-12849
reference_id CVE-2017-12849
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-12849
3
reference_url https://github.com/advisories/GHSA-fwhr-g5r4-xgxf
reference_id GHSA-fwhr-g5r4-xgxf
reference_type
scores
url https://github.com/advisories/GHSA-fwhr-g5r4-xgxf
fixed_packages
0
url pkg:composer/silverstripe/framework@3.5.5-beta1
purl pkg:composer/silverstripe/framework@3.5.5-beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-aygc-4nhm-n7eq
12
vulnerability VCID-b6nm-cphj-wfgw
13
vulnerability VCID-cmwn-cjff-9qau
14
vulnerability VCID-fm87-te3v-pkc8
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-h1y5-n4b7-ckg6
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-k46z-g6jp-57ek
19
vulnerability VCID-ky21-z2d2-sye6
20
vulnerability VCID-mkex-ht2r-cucz
21
vulnerability VCID-n4fk-735u-2baw
22
vulnerability VCID-nute-ndg2-z7ev
23
vulnerability VCID-pkve-yjqy-syc2
24
vulnerability VCID-qdwg-f2bx-1bay
25
vulnerability VCID-qmfy-dxag-uuex
26
vulnerability VCID-r1eg-dwej-5kau
27
vulnerability VCID-tv7h-289s-xub4
28
vulnerability VCID-umhc-fdfh-1fdx
29
vulnerability VCID-uy47-3s8a-hbdn
30
vulnerability VCID-wgdv-etcq-3qhw
31
vulnerability VCID-xg74-3h1h-kqaf
32
vulnerability VCID-y8et-m846-2fc6
33
vulnerability VCID-zdge-zsmz-8ud9
34
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.5.5-beta1
1
url pkg:composer/silverstripe/framework@3.5.5
purl pkg:composer/silverstripe/framework@3.5.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-aygc-4nhm-n7eq
12
vulnerability VCID-b6nm-cphj-wfgw
13
vulnerability VCID-cmwn-cjff-9qau
14
vulnerability VCID-fm87-te3v-pkc8
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-mkex-ht2r-cucz
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-nute-ndg2-z7ev
22
vulnerability VCID-pkve-yjqy-syc2
23
vulnerability VCID-qdwg-f2bx-1bay
24
vulnerability VCID-qmfy-dxag-uuex
25
vulnerability VCID-r1eg-dwej-5kau
26
vulnerability VCID-tv7h-289s-xub4
27
vulnerability VCID-u9e7-1zhg-mygt
28
vulnerability VCID-umhc-fdfh-1fdx
29
vulnerability VCID-uy47-3s8a-hbdn
30
vulnerability VCID-wgdv-etcq-3qhw
31
vulnerability VCID-xg74-3h1h-kqaf
32
vulnerability VCID-y8et-m846-2fc6
33
vulnerability VCID-zdge-zsmz-8ud9
34
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.5.5
2
url pkg:composer/silverstripe/framework@3.6.1-alpha2
purl pkg:composer/silverstripe/framework@3.6.1-alpha2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-aygc-4nhm-n7eq
12
vulnerability VCID-b6nm-cphj-wfgw
13
vulnerability VCID-cmwn-cjff-9qau
14
vulnerability VCID-fm87-te3v-pkc8
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-h1y5-n4b7-ckg6
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-hq36-9ntc-akez
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-mkex-ht2r-cucz
22
vulnerability VCID-n4fk-735u-2baw
23
vulnerability VCID-nute-ndg2-z7ev
24
vulnerability VCID-pkve-yjqy-syc2
25
vulnerability VCID-qdwg-f2bx-1bay
26
vulnerability VCID-qmfy-dxag-uuex
27
vulnerability VCID-r1eg-dwej-5kau
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-u9e7-1zhg-mygt
30
vulnerability VCID-umhc-fdfh-1fdx
31
vulnerability VCID-uy47-3s8a-hbdn
32
vulnerability VCID-wgdv-etcq-3qhw
33
vulnerability VCID-xg74-3h1h-kqaf
34
vulnerability VCID-y8et-m846-2fc6
35
vulnerability VCID-zdge-zsmz-8ud9
36
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.6.1-alpha2
3
url pkg:composer/silverstripe/framework@3.6.1
purl pkg:composer/silverstripe/framework@3.6.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-aygc-4nhm-n7eq
12
vulnerability VCID-b6nm-cphj-wfgw
13
vulnerability VCID-cmwn-cjff-9qau
14
vulnerability VCID-fm87-te3v-pkc8
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-h1y5-n4b7-ckg6
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-hq36-9ntc-akez
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-mkex-ht2r-cucz
22
vulnerability VCID-n4fk-735u-2baw
23
vulnerability VCID-nute-ndg2-z7ev
24
vulnerability VCID-pkve-yjqy-syc2
25
vulnerability VCID-qdwg-f2bx-1bay
26
vulnerability VCID-qmfy-dxag-uuex
27
vulnerability VCID-r1eg-dwej-5kau
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-u9e7-1zhg-mygt
30
vulnerability VCID-umhc-fdfh-1fdx
31
vulnerability VCID-uy47-3s8a-hbdn
32
vulnerability VCID-wgdv-etcq-3qhw
33
vulnerability VCID-xg74-3h1h-kqaf
34
vulnerability VCID-y8et-m846-2fc6
35
vulnerability VCID-zdge-zsmz-8ud9
36
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.6.1
aliases CVE-2017-12849, GHSA-fwhr-g5r4-xgxf
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3x46-q9cb-7ubg
5
url VCID-4h4a-xgrk-d7ec
vulnerability_id VCID-4h4a-xgrk-d7ec
summary 
silverstripe/framework's `Member.Name` is not escaped
The core template `framework/templates/Includes/GridField_print.ss` uses "Printed by $Member.Name".

If the currently logged in members first name or surname contain XSS, this prints the raw HTML out, because Member->getName() just returns the raw FirstName + Surname as a string, which is injected directly.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-013-1.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-013-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/281b0de571fe0ae159ac47891c02acf2214fa619
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/281b0de571fe0ae159ac47891c02acf2214fa619
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/6817c57f64b9eb2b271b81662cd83b074a3daee4
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/6817c57f64b9eb2b271b81662cd83b074a3daee4
4
reference_url https://github.com/silverstripe/silverstripe-framework/commit/83e3302c0425d9b0e4fe42e82e3df03379f4dca5
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/83e3302c0425d9b0e4fe42e82e3df03379f4dca5
5
reference_url https://github.com/silverstripe/silverstripe-framework/commit/8bbf1caae665a07b3e44e8d5d32556a03d38c296
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/8bbf1caae665a07b3e44e8d5d32556a03d38c296
6
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-013
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-013
7
reference_url https://github.com/advisories/GHSA-r9vp-fp72-xgf7
reference_id GHSA-r9vp-fp72-xgf7
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-r9vp-fp72-xgf7
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
aliases GHSA-r9vp-fp72-xgf7
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4h4a-xgrk-d7ec
6
url VCID-5cfa-whq6-9ucp
vulnerability_id VCID-5cfa-whq6-9ucp
summary 
Silverstripe Framework has a XSS in form messages
In some cases, form messages can contain HTML markup. This is an intentional feature, allowing links and other relevant HTML markup for the given message.

Some form messages include content that the user can provide. There are scenarios in the CMS where that content doesn't get correctly sanitised prior to being included in the form message, resulting in an XSS vulnerability.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-53277
reference_id
reference_type
scores
0
value 0.01452
scoring_system epss
scoring_elements 0.81169
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-53277
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/74904f539347b7d1f8c5b5fb9e28d62ff251ee00
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T14:52:17Z/
url https://github.com/silverstripe/silverstripe-framework/commit/74904f539347b7d1f8c5b5fb9e28d62ff251ee00
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-53277
reference_id CVE-2024-53277
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-53277
4
reference_url https://www.silverstripe.org/download/security-releases/cve-2024-53277
reference_id CVE-2024-53277
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T14:52:17Z/
url https://www.silverstripe.org/download/security-releases/cve-2024-53277
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-53277.yaml
reference_id CVE-2024-53277.YAML
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-53277.yaml
6
reference_url https://github.com/advisories/GHSA-ff6q-3c9c-6cf5
reference_id GHSA-ff6q-3c9c-6cf5
reference_type
scores
url https://github.com/advisories/GHSA-ff6q-3c9c-6cf5
7
reference_url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-ff6q-3c9c-6cf5
reference_id GHSA-ff6q-3c9c-6cf5
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T14:52:17Z/
url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-ff6q-3c9c-6cf5
fixed_packages
0
url pkg:composer/silverstripe/framework@5.3.8
purl pkg:composer/silverstripe/framework@5.3.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2hk2-hzyh-wbhf
1
vulnerability VCID-79qx-v5uu-jyf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@5.3.8
1
url pkg:composer/silverstripe/framework@6.0.0-alpha1
purl pkg:composer/silverstripe/framework@6.0.0-alpha1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@6.0.0-alpha1
aliases CVE-2024-53277, GHSA-ff6q-3c9c-6cf5
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5cfa-whq6-9ucp
7
url VCID-79qx-v5uu-jyf2
vulnerability_id VCID-79qx-v5uu-jyf2
summary 
Silverstripe Framework has a XSS vulnerability in HTML editor
A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it.

The server-side sanitisation logic has been updated to sanitise against this attack.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-30148
reference_id
reference_type
scores
0
value 0.00224
scoring_system epss
scoring_elements 0.45229
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-30148
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/e99cfd62d160d145a76fcf9631e6b11226e42358
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-10T13:34:01Z/
url https://github.com/silverstripe/silverstripe-framework/commit/e99cfd62d160d145a76fcf9631e6b11226e42358
3
reference_url https://github.com/silverstripe/silverstripe-framework/pull/11682
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/pull/11682
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-30148
reference_id CVE-2025-30148
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-30148
5
reference_url https://www.silverstripe.org/download/security-releases/cve-2025-30148
reference_id CVE-2025-30148
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-10T13:34:01Z/
url https://www.silverstripe.org/download/security-releases/cve-2025-30148
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2025-30148.yaml
reference_id CVE-2025-30148.YAML
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2025-30148.yaml
7
reference_url https://github.com/advisories/GHSA-rhx4-hvx9-j387
reference_id GHSA-rhx4-hvx9-j387
reference_type
scores
url https://github.com/advisories/GHSA-rhx4-hvx9-j387
8
reference_url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-rhx4-hvx9-j387
reference_id GHSA-rhx4-hvx9-j387
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-10T13:34:01Z/
url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-rhx4-hvx9-j387
fixed_packages
0
url pkg:composer/silverstripe/framework@5.3.23
purl pkg:composer/silverstripe/framework@5.3.23
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@5.3.23
aliases CVE-2025-30148, GHSA-rhx4-hvx9-j387
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-79qx-v5uu-jyf2
8
url VCID-7ek4-6y31-1qcs
vulnerability_id VCID-7ek4-6y31-1qcs
summary 
Pre-existing alc_enc cookies log users in if remember me is disabled
If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users.
references
0
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-014/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2016-014/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
3
url pkg:composer/silverstripe/framework@4.0.0-alpha1
purl pkg:composer/silverstripe/framework@4.0.0-alpha1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-qmfy-dxag-uuex
19
vulnerability VCID-r1eg-dwej-5kau
20
vulnerability VCID-tv7h-289s-xub4
21
vulnerability VCID-uy47-3s8a-hbdn
22
vulnerability VCID-wgdv-etcq-3qhw
23
vulnerability VCID-xg74-3h1h-kqaf
24
vulnerability VCID-y8et-m846-2fc6
25
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.0-alpha1
aliases SS-2016-014
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7ek4-6y31-1qcs
9
url VCID-7hxq-cp29-r7dh
vulnerability_id VCID-7hxq-cp29-r7dh
summary 
Cross-site Scripting
In SilverStripe asset-admin, there is XSS in file titles managed through the CMS.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-14272
reference_id
reference_type
scores
0
value 0.00347
scoring_system epss
scoring_elements 0.57587
published_at 2026-06-05T12:55:00Z
1
value 0.00347
scoring_system epss
scoring_elements 0.57535
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-14272
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-14272.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-14272.yaml
3
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
4
reference_url https://www.silverstripe.org/blog/tag/release
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/blog/tag/release
5
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-14272
reference_id CVE-2019-14272
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-14272
7
reference_url https://www.silverstripe.org/download/security-releases/CVE-2019-14272
reference_id CVE-2019-14272
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2019-14272
fixed_packages
0
url pkg:composer/silverstripe/framework@4.0.1-rc1
purl pkg:composer/silverstripe/framework@4.0.1-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-24a5-ruc4-bycq
4
vulnerability VCID-2hk2-hzyh-wbhf
5
vulnerability VCID-37d1-tt74-yyfm
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7gak-15m5-j3f5
9
vulnerability VCID-7w7t-3783-1kbs
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9t4k-8hsz-bfdw
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a1p9-cwzb-kbgb
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-aj7q-x4hc-xbdm
17
vulnerability VCID-aygc-4nhm-n7eq
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-ca4q-xd4v-vqfe
20
vulnerability VCID-cmwn-cjff-9qau
21
vulnerability VCID-fm87-te3v-pkc8
22
vulnerability VCID-fmfu-81xu-pfdy
23
vulnerability VCID-g7kn-gn2m-myc3
24
vulnerability VCID-gnpw-s9hp-wqfs
25
vulnerability VCID-h9g1-7wez-8qft
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hq36-9ntc-akez
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-m3us-9sft-wbh8
31
vulnerability VCID-n4fk-735u-2baw
32
vulnerability VCID-nute-ndg2-z7ev
33
vulnerability VCID-nzcm-xbxx-wyf9
34
vulnerability VCID-p2m9-rejx-e3e9
35
vulnerability VCID-pkve-yjqy-syc2
36
vulnerability VCID-qmfy-dxag-uuex
37
vulnerability VCID-r1eg-dwej-5kau
38
vulnerability VCID-ru3j-21j8-ayhm
39
vulnerability VCID-tsdn-bu3d-ubaf
40
vulnerability VCID-tv7h-289s-xub4
41
vulnerability VCID-uy47-3s8a-hbdn
42
vulnerability VCID-wgdv-etcq-3qhw
43
vulnerability VCID-xg74-3h1h-kqaf
44
vulnerability VCID-xm4q-u96p-57dd
45
vulnerability VCID-y8et-m846-2fc6
46
vulnerability VCID-ytbc-8mhd-b3fc
47
vulnerability VCID-yxuh-bxh5-z3cw
48
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.1-rc1
1
url pkg:composer/silverstripe/framework@4.0.1
purl pkg:composer/silverstripe/framework@4.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-24a5-ruc4-bycq
4
vulnerability VCID-2hk2-hzyh-wbhf
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7gak-15m5-j3f5
8
vulnerability VCID-7w7t-3783-1kbs
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9t4k-8hsz-bfdw
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-aj7q-x4hc-xbdm
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-ca4q-xd4v-vqfe
17
vulnerability VCID-cmwn-cjff-9qau
18
vulnerability VCID-fmfu-81xu-pfdy
19
vulnerability VCID-g7kn-gn2m-myc3
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-h9g1-7wez-8qft
22
vulnerability VCID-hcuz-gz3w-97ew
23
vulnerability VCID-hq36-9ntc-akez
24
vulnerability VCID-k46z-g6jp-57ek
25
vulnerability VCID-ky21-z2d2-sye6
26
vulnerability VCID-m3us-9sft-wbh8
27
vulnerability VCID-n4fk-735u-2baw
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-nzcm-xbxx-wyf9
30
vulnerability VCID-p2m9-rejx-e3e9
31
vulnerability VCID-pkve-yjqy-syc2
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-ru3j-21j8-ayhm
35
vulnerability VCID-tsdn-bu3d-ubaf
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-uy47-3s8a-hbdn
38
vulnerability VCID-wgdv-etcq-3qhw
39
vulnerability VCID-xg74-3h1h-kqaf
40
vulnerability VCID-xm4q-u96p-57dd
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-ytbc-8mhd-b3fc
43
vulnerability VCID-yxuh-bxh5-z3cw
44
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.1
2
url pkg:composer/silverstripe/framework@4.3.5
purl pkg:composer/silverstripe/framework@4.3.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-pkve-yjqy-syc2
21
vulnerability VCID-qmfy-dxag-uuex
22
vulnerability VCID-ru3j-21j8-ayhm
23
vulnerability VCID-tv7h-289s-xub4
24
vulnerability VCID-uy47-3s8a-hbdn
25
vulnerability VCID-wgdv-etcq-3qhw
26
vulnerability VCID-xm4q-u96p-57dd
27
vulnerability VCID-ytbc-8mhd-b3fc
28
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.5
3
url pkg:composer/silverstripe/framework@4.4.4
purl pkg:composer/silverstripe/framework@4.4.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-5dt7-nc8t-nqgh
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7gak-15m5-j3f5
8
vulnerability VCID-7w7t-3783-1kbs
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9t4k-8hsz-bfdw
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-ca4q-xd4v-vqfe
15
vulnerability VCID-fmfu-81xu-pfdy
16
vulnerability VCID-gnpw-s9hp-wqfs
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-k46z-g6jp-57ek
19
vulnerability VCID-ky21-z2d2-sye6
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.4.4
aliases CVE-2019-14272, GHSA-jgw2-f5mx-rg7h
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7hxq-cp29-r7dh
10
url VCID-7jm4-cjg3-rkcz
vulnerability_id VCID-7jm4-cjg3-rkcz
summary 
silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled
If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-014-1.yaml
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-014-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/1c7d5de51bcdf16ebb21c5a0ebe5fe9e31f9a822
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/1c7d5de51bcdf16ebb21c5a0ebe5fe9e31f9a822
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/b1f449762b5d11658b11d5036d5ae361a95fd61e
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/b1f449762b5d11658b11d5036d5ae361a95fd61e
4
reference_url https://github.com/silverstripe/silverstripe-framework/commit/d1163d87b70e3e147f22a1e423b9f70f6fd85e8f
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/d1163d87b70e3e147f22a1e423b9f70f6fd85e8f
5
reference_url https://github.com/silverstripe/silverstripe-framework/commit/fa7f5af8618a83c865b11fd6cc981ad9661046e6
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/fa7f5af8618a83c865b11fd6cc981ad9661046e6
6
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-014
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-014
7
reference_url https://github.com/advisories/GHSA-5r8w-66hq-rc39
reference_id GHSA-5r8w-66hq-rc39
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-5r8w-66hq-rc39
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
aliases GHSA-5r8w-66hq-rc39
risk_score 1.4
exploitability 0.5
weighted_severity 2.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7jm4-cjg3-rkcz
11
url VCID-86vg-4j71-hkgr
vulnerability_id VCID-86vg-4j71-hkgr
summary 
Silverstripe Framework has a XSS via insert media remote file oembed
When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on both the CMS and the front-end of the website.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-47605
reference_id
reference_type
scores
0
value 0.07112
scoring_system epss
scoring_elements 0.91697
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-47605
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/09b5052c86932f273e0d733428c9aade70ff2a4a
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T14:53:47Z/
url https://github.com/silverstripe/silverstripe-framework/commit/09b5052c86932f273e0d733428c9aade70ff2a4a
3
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52199.txt
reference_id CVE-2024-47605
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52199.txt
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-47605
reference_id CVE-2024-47605
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-47605
5
reference_url https://www.silverstripe.org/download/security-releases/cve-2024-47605
reference_id CVE-2024-47605
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T14:53:47Z/
url https://www.silverstripe.org/download/security-releases/cve-2024-47605
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-47605.yaml
reference_id CVE-2024-47605.YAML
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-47605.yaml
7
reference_url https://github.com/advisories/GHSA-7cmp-cgg8-4c82
reference_id GHSA-7cmp-cgg8-4c82
reference_type
scores
url https://github.com/advisories/GHSA-7cmp-cgg8-4c82
8
reference_url https://github.com/silverstripe/silverstripe-asset-admin/security/advisories/GHSA-7cmp-cgg8-4c82
reference_id GHSA-7cmp-cgg8-4c82
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T14:53:47Z/
url https://github.com/silverstripe/silverstripe-asset-admin/security/advisories/GHSA-7cmp-cgg8-4c82
fixed_packages
0
url pkg:composer/silverstripe/framework@5.3.8
purl pkg:composer/silverstripe/framework@5.3.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2hk2-hzyh-wbhf
1
vulnerability VCID-79qx-v5uu-jyf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@5.3.8
1
url pkg:composer/silverstripe/framework@6.0.0-alpha1
purl pkg:composer/silverstripe/framework@6.0.0-alpha1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@6.0.0-alpha1
aliases CVE-2024-47605, GHSA-7cmp-cgg8-4c82
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-86vg-4j71-hkgr
12
url VCID-8u5c-6vx3-mfcr
vulnerability_id VCID-8u5c-6vx3-mfcr
summary 
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message
> [!IMPORTANT]
> This vulnerability only affects sites which are in the "dev" environment mode. If your production website is in "dev" mode, it has been misconfigured, and you should immediately swap it to "live" mode.
> See https://docs.silverstripe.org/en/developer_guides/debugging/environment_types/ for more information.

If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message.
references
0
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
1
reference_url https://github.com/silverstripe/silverstripe-framework/commit/a555dad4ec73c929f6316bcb4019eb325a5b77d8
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/a555dad4ec73c929f6316bcb4019eb325a5b77d8
2
reference_url https://www.silverstripe.org/download/security-releases/ss-2024-002
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2024-002
3
reference_url https://github.com/advisories/GHSA-mqf3-qpc3-g26q
reference_id GHSA-mqf3-qpc3-g26q
reference_type
scores
url https://github.com/advisories/GHSA-mqf3-qpc3-g26q
4
reference_url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-mqf3-qpc3-g26q
reference_id GHSA-mqf3-qpc3-g26q
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-mqf3-qpc3-g26q
fixed_packages
0
url pkg:composer/silverstripe/framework@5.3.8
purl pkg:composer/silverstripe/framework@5.3.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2hk2-hzyh-wbhf
1
vulnerability VCID-79qx-v5uu-jyf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@5.3.8
1
url pkg:composer/silverstripe/framework@6.0.0-alpha1
purl pkg:composer/silverstripe/framework@6.0.0-alpha1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@6.0.0-alpha1
aliases GHSA-mqf3-qpc3-g26q
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8u5c-6vx3-mfcr
13
url VCID-9hf4-djcv-67d7
vulnerability_id VCID-9hf4-djcv-67d7
summary 
silverstripe/framework ReadOnly transformation for formfields exploitable
Form fields returning isReadonly() as true are vulnerable to reflected XSS injections. This includes ReadonlyField, LookupField, HTMLReadonlyField, as well as special purpose fields like TimeField_Readonly. Values submitted to through these form fields are not filtered out from the form session data, and might be shown to the user depending on the form behaviour. For example, form validation errors cause the form to re-render with previously submitted values by default.

SilverStripe forms automatically load values from request data (GET and POST), which enables malicious use of URLs if your form uses these fields and doesn't overwrite data on form construction.

Readonly and disabled form fields are already filtered out in Form->saveInto(), so maliciously submitted data on these fields doesn't make it into the database unless you are accessing form values directly in your saving logic.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-010-1.yaml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-010-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/8336cb96b9600dacafa8a525c92662345b52cfae
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/8336cb96b9600dacafa8a525c92662345b52cfae
3
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-010
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-010
4
reference_url https://github.com/advisories/GHSA-97jm-g33h-f46g
reference_id GHSA-97jm-g33h-f46g
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-97jm-g33h-f46g
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.6
purl pkg:composer/silverstripe/framework@3.2.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3x46-q9cb-7ubg
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-b6nm-cphj-wfgw
12
vulnerability VCID-b95v-49p7-fkas
13
vulnerability VCID-c6bz-jwhm-vkgp
14
vulnerability VCID-cmwn-cjff-9qau
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-mkex-ht2r-cucz
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-nute-ndg2-z7ev
22
vulnerability VCID-pkve-yjqy-syc2
23
vulnerability VCID-qdwg-f2bx-1bay
24
vulnerability VCID-qmfy-dxag-uuex
25
vulnerability VCID-r1eg-dwej-5kau
26
vulnerability VCID-sg62-98yy-2kd7
27
vulnerability VCID-t81f-5b8z-hyht
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-umhc-fdfh-1fdx
30
vulnerability VCID-uy47-3s8a-hbdn
31
vulnerability VCID-wgdv-etcq-3qhw
32
vulnerability VCID-xg74-3h1h-kqaf
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.6
1
url pkg:composer/silverstripe/framework@3.3.4
purl pkg:composer/silverstripe/framework@3.3.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3x46-q9cb-7ubg
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-b6nm-cphj-wfgw
12
vulnerability VCID-b95v-49p7-fkas
13
vulnerability VCID-c6bz-jwhm-vkgp
14
vulnerability VCID-cmwn-cjff-9qau
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-mkex-ht2r-cucz
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-nute-ndg2-z7ev
22
vulnerability VCID-pkve-yjqy-syc2
23
vulnerability VCID-qdwg-f2bx-1bay
24
vulnerability VCID-qmfy-dxag-uuex
25
vulnerability VCID-r1eg-dwej-5kau
26
vulnerability VCID-sg62-98yy-2kd7
27
vulnerability VCID-t81f-5b8z-hyht
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-umhc-fdfh-1fdx
30
vulnerability VCID-uy47-3s8a-hbdn
31
vulnerability VCID-wgdv-etcq-3qhw
32
vulnerability VCID-xg74-3h1h-kqaf
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.4
2
url pkg:composer/silverstripe/framework@3.4.2
purl pkg:composer/silverstripe/framework@3.4.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3j6f-5c14-uubc
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4qjj-wqg5-dbay
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7hxq-cp29-r7dh
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-bwrh-updj-zkfs
16
vulnerability VCID-c6bz-jwhm-vkgp
17
vulnerability VCID-cmwn-cjff-9qau
18
vulnerability VCID-gnpw-s9hp-wqfs
19
vulnerability VCID-hcuz-gz3w-97ew
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-njph-ua7r-auaq
25
vulnerability VCID-nute-ndg2-z7ev
26
vulnerability VCID-pkve-yjqy-syc2
27
vulnerability VCID-qdwg-f2bx-1bay
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.2
aliases GHSA-97jm-g33h-f46g
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9hf4-djcv-67d7
14
url VCID-9y5u-qyzd-3ud9
vulnerability_id VCID-9y5u-qyzd-3ud9
summary 
Exposure of Sensitive Information to an Unauthorized Actor
Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-48714
reference_id
reference_type
scores
0
value 0.00226
scoring_system epss
scoring_elements 0.45478
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-48714
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-48714.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-48714.yaml
2
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-48714
reference_id CVE-2023-48714
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-48714
4
reference_url https://www.silverstripe.org/download/security-releases/CVE-2023-48714
reference_id CVE-2023-48714
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-23T23:32:05Z/
url https://www.silverstripe.org/download/security-releases/CVE-2023-48714
5
reference_url https://github.com/advisories/GHSA-qm2j-qvq3-j29v
reference_id GHSA-qm2j-qvq3-j29v
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qm2j-qvq3-j29v
6
reference_url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qvq3-j29v
reference_id GHSA-qm2j-qvq3-j29v
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-23T23:32:05Z/
url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qvq3-j29v
fixed_packages
0
url pkg:composer/silverstripe/framework@4.13.39
purl pkg:composer/silverstripe/framework@4.13.39
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-86vg-4j71-hkgr
5
vulnerability VCID-8u5c-6vx3-mfcr
6
vulnerability VCID-k46z-g6jp-57ek
7
vulnerability VCID-ky21-z2d2-sye6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.13.39
1
url pkg:composer/silverstripe/framework@5.1.11
purl pkg:composer/silverstripe/framework@5.1.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-86vg-4j71-hkgr
5
vulnerability VCID-8u5c-6vx3-mfcr
6
vulnerability VCID-k46z-g6jp-57ek
7
vulnerability VCID-ky21-z2d2-sye6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@5.1.11
aliases CVE-2023-48714, GHSA-qm2j-qvq3-j29v
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9y5u-qyzd-3ud9
15
url VCID-a7cf-kpzy-xudd
vulnerability_id VCID-a7cf-kpzy-xudd
summary 
URL Redirection to Untrusted Site ('Open Redirect')
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-22729
reference_id
reference_type
scores
0
value 0.00203
scoring_system epss
scoring_elements 0.42323
published_at 2026-06-05T12:55:00Z
1
value 0.00203
scoring_system epss
scoring_elements 0.42248
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-22729
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-22729.yaml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-22729.yaml
2
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/1a5bb4cbece1721203977910b8ecd8b79c18dc77
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T16:10:14Z/
url https://github.com/silverstripe/silverstripe-framework/commit/1a5bb4cbece1721203977910b8ecd8b79c18dc77
4
reference_url https://www.silverstripe.org/download/security-releases/cve-2023-22729
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2023-22729
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-22729
reference_id CVE-2023-22729
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-22729
6
reference_url https://github.com/advisories/GHSA-fw84-xgm8-9jmv
reference_id GHSA-fw84-xgm8-9jmv
reference_type
scores
url https://github.com/advisories/GHSA-fw84-xgm8-9jmv
7
reference_url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-fw84-xgm8-9jmv
reference_id GHSA-fw84-xgm8-9jmv
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T16:10:14Z/
url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-fw84-xgm8-9jmv
fixed_packages
0
url pkg:composer/silverstripe/framework@4.12.5
purl pkg:composer/silverstripe/framework@4.12.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-86vg-4j71-hkgr
5
vulnerability VCID-8u5c-6vx3-mfcr
6
vulnerability VCID-9y5u-qyzd-3ud9
7
vulnerability VCID-gnpw-s9hp-wqfs
8
vulnerability VCID-k46z-g6jp-57ek
9
vulnerability VCID-ky21-z2d2-sye6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.12.5
aliases CVE-2023-22729, GHSA-fw84-xgm8-9jmv
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-a7cf-kpzy-xudd
16
url VCID-at1s-qxsg-5yfs
vulnerability_id VCID-at1s-qxsg-5yfs
summary 
XSS In OptionsetField and CheckboxSetField
List of key / value pairs assigned to `OptionsetField` or `CheckboxSetField` do not have a default casting assigned to them. The effect of this is a potential XSS vulnerability in lists where either key or value contain unescaped HTML.
references
0
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-015/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2016-015/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
3
url pkg:composer/silverstripe/framework@4.0.0-alpha1
purl pkg:composer/silverstripe/framework@4.0.0-alpha1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-qmfy-dxag-uuex
19
vulnerability VCID-r1eg-dwej-5kau
20
vulnerability VCID-tv7h-289s-xub4
21
vulnerability VCID-uy47-3s8a-hbdn
22
vulnerability VCID-wgdv-etcq-3qhw
23
vulnerability VCID-xg74-3h1h-kqaf
24
vulnerability VCID-y8et-m846-2fc6
25
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.0-alpha1
aliases SS-2016-015
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-at1s-qxsg-5yfs
17
url VCID-b6nm-cphj-wfgw
vulnerability_id VCID-b6nm-cphj-wfgw
summary 
Improper Privilege Management
In SilverStripe, there is access escalation for CMS users with limited access through permission cache pollution.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-12617
reference_id
reference_type
scores
0
value 0.00304
scoring_system epss
scoring_elements 0.53948
published_at 2026-06-04T12:55:00Z
1
value 0.00304
scoring_system epss
scoring_elements 0.54005
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-12617
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
0
value 2.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12617.yaml
reference_id
reference_type
scores
0
value 2.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12617.yaml
3
reference_url https://www.silverstripe.org/blog/tag/release
reference_id
reference_type
scores
0
value 2.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/blog/tag/release
4
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 2.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
5
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
6
reference_url https://www.silverstripe.org/download/security-releases/cve-2019-12617
reference_id
reference_type
scores
0
value 2.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2019-12617
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-12617
reference_id CVE-2019-12617
reference_type
scores
0
value 2.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-12617
8
reference_url https://www.silverstripe.org/download/security-releases/cve-2019-12617/
reference_id CVE-2019-12617
reference_type
scores
url https://www.silverstripe.org/download/security-releases/cve-2019-12617/
9
reference_url https://www.silverstripe.org/download/security-releases/CVE-2019-12617
reference_id CVE-2019-12617
reference_type
scores
0
value 2.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2019-12617
10
reference_url https://github.com/advisories/GHSA-6r58-4xgr-gm6m
reference_id GHSA-6r58-4xgr-gm6m
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6r58-4xgr-gm6m
fixed_packages
0
url pkg:composer/silverstripe/framework@4.3.4
purl pkg:composer/silverstripe/framework@4.3.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-nzcm-xbxx-wyf9
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.4
1
url pkg:composer/silverstripe/framework@4.3.5
purl pkg:composer/silverstripe/framework@4.3.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-pkve-yjqy-syc2
21
vulnerability VCID-qmfy-dxag-uuex
22
vulnerability VCID-ru3j-21j8-ayhm
23
vulnerability VCID-tv7h-289s-xub4
24
vulnerability VCID-uy47-3s8a-hbdn
25
vulnerability VCID-wgdv-etcq-3qhw
26
vulnerability VCID-xm4q-u96p-57dd
27
vulnerability VCID-ytbc-8mhd-b3fc
28
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.5
2
url pkg:composer/silverstripe/framework@4.4.4
purl pkg:composer/silverstripe/framework@4.4.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-5dt7-nc8t-nqgh
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7gak-15m5-j3f5
8
vulnerability VCID-7w7t-3783-1kbs
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9t4k-8hsz-bfdw
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-ca4q-xd4v-vqfe
15
vulnerability VCID-fmfu-81xu-pfdy
16
vulnerability VCID-gnpw-s9hp-wqfs
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-k46z-g6jp-57ek
19
vulnerability VCID-ky21-z2d2-sye6
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.4.4
aliases CVE-2019-12617, GHSA-6r58-4xgr-gm6m
risk_score 1.4
exploitability 0.5
weighted_severity 2.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-b6nm-cphj-wfgw
18
url VCID-b95v-49p7-fkas
vulnerability_id VCID-b95v-49p7-fkas
summary 
Cross-site Scripting
SilverStripe CMS has an XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an `admin/assets/add` pathname.
references
0
reference_url http://lists.openwall.net/full-disclosure/2017/09/14/2
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.openwall.net/full-disclosure/2017/09/14/2
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-14498
reference_id
reference_type
scores
0
value 0.00375
scoring_system epss
scoring_elements 0.59498
published_at 2026-06-05T12:55:00Z
1
value 0.00375
scoring_system epss
scoring_elements 0.59447
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-14498
2
reference_url https://docs.silverstripe.org/en/3/changelogs/3.6.1
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://docs.silverstripe.org/en/3/changelogs/3.6.1
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/25b77a2ff8deabe8e8894002b9a5647eaec27b0a
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/25b77a2ff8deabe8e8894002b9a5647eaec27b0a
4
reference_url https://github.com/silverstripe/silverstripe-installer/commit/c25478bef75cc5482852e80a1fa6f1f0e6460e39
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-installer/commit/c25478bef75cc5482852e80a1fa6f1f0e6460e39
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-14498
reference_id CVE-2017-14498
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-14498
6
reference_url https://github.com/advisories/GHSA-j696-6m57-mcrv
reference_id GHSA-j696-6m57-mcrv
reference_type
scores
url https://github.com/advisories/GHSA-j696-6m57-mcrv
fixed_packages
0
url pkg:composer/silverstripe/framework@3.6.1-alpha2
purl pkg:composer/silverstripe/framework@3.6.1-alpha2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-aygc-4nhm-n7eq
12
vulnerability VCID-b6nm-cphj-wfgw
13
vulnerability VCID-cmwn-cjff-9qau
14
vulnerability VCID-fm87-te3v-pkc8
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-h1y5-n4b7-ckg6
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-hq36-9ntc-akez
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-mkex-ht2r-cucz
22
vulnerability VCID-n4fk-735u-2baw
23
vulnerability VCID-nute-ndg2-z7ev
24
vulnerability VCID-pkve-yjqy-syc2
25
vulnerability VCID-qdwg-f2bx-1bay
26
vulnerability VCID-qmfy-dxag-uuex
27
vulnerability VCID-r1eg-dwej-5kau
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-u9e7-1zhg-mygt
30
vulnerability VCID-umhc-fdfh-1fdx
31
vulnerability VCID-uy47-3s8a-hbdn
32
vulnerability VCID-wgdv-etcq-3qhw
33
vulnerability VCID-xg74-3h1h-kqaf
34
vulnerability VCID-y8et-m846-2fc6
35
vulnerability VCID-zdge-zsmz-8ud9
36
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.6.1-alpha2
1
url pkg:composer/silverstripe/framework@3.6.1
purl pkg:composer/silverstripe/framework@3.6.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-aygc-4nhm-n7eq
12
vulnerability VCID-b6nm-cphj-wfgw
13
vulnerability VCID-cmwn-cjff-9qau
14
vulnerability VCID-fm87-te3v-pkc8
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-h1y5-n4b7-ckg6
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-hq36-9ntc-akez
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-mkex-ht2r-cucz
22
vulnerability VCID-n4fk-735u-2baw
23
vulnerability VCID-nute-ndg2-z7ev
24
vulnerability VCID-pkve-yjqy-syc2
25
vulnerability VCID-qdwg-f2bx-1bay
26
vulnerability VCID-qmfy-dxag-uuex
27
vulnerability VCID-r1eg-dwej-5kau
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-u9e7-1zhg-mygt
30
vulnerability VCID-umhc-fdfh-1fdx
31
vulnerability VCID-uy47-3s8a-hbdn
32
vulnerability VCID-wgdv-etcq-3qhw
33
vulnerability VCID-xg74-3h1h-kqaf
34
vulnerability VCID-y8et-m846-2fc6
35
vulnerability VCID-zdge-zsmz-8ud9
36
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.6.1
aliases CVE-2017-14498, GHSA-j696-6m57-mcrv
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-b95v-49p7-fkas
19
url VCID-c437-w2zy-y7c9
vulnerability_id VCID-c437-w2zy-y7c9
summary 
ChangePasswordForm doesn't check Member::canLogIn()
After performing a password reset, `ChangePasswordForm::doChangePassword()` logs in the user without checking `Member::canLogIn()`. This presents an issue for sites that are using the extension point in that method to deny access to users (for example members that have not been “approved”, or members that have had their access revoked temporarily). It looks like `Member::canLogIn()` was originally designed to only be used for checking whether the user is locked out (due to too many incorrect login attempts) but has been opened up to other uses.
references
0
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-011/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2016-011/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.10-stable
purl pkg:composer/silverstripe/framework@3.4.10-stable
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.10-stable
3
url pkg:composer/silverstripe/framework@4.0.0-alpha1
purl pkg:composer/silverstripe/framework@4.0.0-alpha1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-qmfy-dxag-uuex
19
vulnerability VCID-r1eg-dwej-5kau
20
vulnerability VCID-tv7h-289s-xub4
21
vulnerability VCID-uy47-3s8a-hbdn
22
vulnerability VCID-wgdv-etcq-3qhw
23
vulnerability VCID-xg74-3h1h-kqaf
24
vulnerability VCID-y8et-m846-2fc6
25
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.0-alpha1
aliases SS-2016-011
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-c437-w2zy-y7c9
20
url VCID-c6bz-jwhm-vkgp
vulnerability_id VCID-c6bz-jwhm-vkgp
summary 
Cross-site Scripting
There is an XSS in SilverStripe CMS.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-5197
reference_id
reference_type
scores
0
value 0.00265
scoring_system epss
scoring_elements 0.5014
published_at 2026-06-04T12:55:00Z
1
value 0.00265
scoring_system epss
scoring_elements 0.50201
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-5197
1
reference_url https://web.archive.org/web/20210123234141/http://www.securityfocus.com/bid/96572
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210123234141/http://www.securityfocus.com/bid/96572
2
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
3
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
4
reference_url http://www.securityfocus.com/bid/96572
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/96572
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-5197
reference_id CVE-2017-5197
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-5197
6
reference_url https://github.com/advisories/GHSA-xmjh-wjc5-wg4h
reference_id GHSA-xmjh-wjc5-wg4h
reference_type
scores
url https://github.com/advisories/GHSA-xmjh-wjc5-wg4h
fixed_packages
0
url pkg:composer/silverstripe/framework@3.4.4-rc1
purl pkg:composer/silverstripe/framework@3.4.4-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3j6f-5c14-uubc
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4qjj-wqg5-dbay
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7hxq-cp29-r7dh
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-bwrh-updj-zkfs
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-mkex-ht2r-cucz
22
vulnerability VCID-n4fk-735u-2baw
23
vulnerability VCID-njph-ua7r-auaq
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qmfy-dxag-uuex
28
vulnerability VCID-r1eg-dwej-5kau
29
vulnerability VCID-sg62-98yy-2kd7
30
vulnerability VCID-tv7h-289s-xub4
31
vulnerability VCID-umhc-fdfh-1fdx
32
vulnerability VCID-uy47-3s8a-hbdn
33
vulnerability VCID-wgdv-etcq-3qhw
34
vulnerability VCID-xg74-3h1h-kqaf
35
vulnerability VCID-y8et-m846-2fc6
36
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.4-rc1
1
url pkg:composer/silverstripe/framework@3.4.4
purl pkg:composer/silverstripe/framework@3.4.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3j6f-5c14-uubc
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4qjj-wqg5-dbay
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7hxq-cp29-r7dh
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-bwrh-updj-zkfs
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-mkex-ht2r-cucz
22
vulnerability VCID-n4fk-735u-2baw
23
vulnerability VCID-nute-ndg2-z7ev
24
vulnerability VCID-pkve-yjqy-syc2
25
vulnerability VCID-qdwg-f2bx-1bay
26
vulnerability VCID-qmfy-dxag-uuex
27
vulnerability VCID-r1eg-dwej-5kau
28
vulnerability VCID-sg62-98yy-2kd7
29
vulnerability VCID-tv7h-289s-xub4
30
vulnerability VCID-umhc-fdfh-1fdx
31
vulnerability VCID-uy47-3s8a-hbdn
32
vulnerability VCID-wgdv-etcq-3qhw
33
vulnerability VCID-xg74-3h1h-kqaf
34
vulnerability VCID-y8et-m846-2fc6
35
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.4
2
url pkg:composer/silverstripe/framework@3.5.2-rc1
purl pkg:composer/silverstripe/framework@3.5.2-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-aygc-4nhm-n7eq
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-cmwn-cjff-9qau
19
vulnerability VCID-fm87-te3v-pkc8
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-h1y5-n4b7-ckg6
22
vulnerability VCID-hcuz-gz3w-97ew
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qmfy-dxag-uuex
32
vulnerability VCID-r1eg-dwej-5kau
33
vulnerability VCID-sg62-98yy-2kd7
34
vulnerability VCID-tv7h-289s-xub4
35
vulnerability VCID-umhc-fdfh-1fdx
36
vulnerability VCID-uy47-3s8a-hbdn
37
vulnerability VCID-wgdv-etcq-3qhw
38
vulnerability VCID-xg74-3h1h-kqaf
39
vulnerability VCID-y8et-m846-2fc6
40
vulnerability VCID-zdge-zsmz-8ud9
41
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.5.2-rc1
3
url pkg:composer/silverstripe/framework@3.5.2
purl pkg:composer/silverstripe/framework@3.5.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-aygc-4nhm-n7eq
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-cmwn-cjff-9qau
19
vulnerability VCID-fm87-te3v-pkc8
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-h1y5-n4b7-ckg6
22
vulnerability VCID-hcuz-gz3w-97ew
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-nute-ndg2-z7ev
28
vulnerability VCID-pkve-yjqy-syc2
29
vulnerability VCID-qdwg-f2bx-1bay
30
vulnerability VCID-qmfy-dxag-uuex
31
vulnerability VCID-r1eg-dwej-5kau
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
39
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.5.2
aliases CVE-2017-5197, GHSA-xmjh-wjc5-wg4h
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-c6bz-jwhm-vkgp
21
url VCID-cmwn-cjff-9qau
vulnerability_id VCID-cmwn-cjff-9qau
summary 
Session Fixation
SilverStripe allows session fixation in the "change password" form.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-12203
reference_id
reference_type
scores
0
value 0.00054
scoring_system epss
scoring_elements 0.17184
published_at 2026-06-05T12:55:00Z
1
value 0.00054
scoring_system epss
scoring_elements 0.17108
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-12203
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12203.yaml
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12203.yaml
3
reference_url https://github.com/silverstripe/silverstripe-framework/blob/4/docs/en/04_Changelogs/4.4.4.md#444
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/blob/4/docs/en/04_Changelogs/4.4.4.md#444
4
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
5
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
6
reference_url https://www.silverstripe.org/download/security-releases/cve-2019-12203
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2019-12203
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-12203
reference_id CVE-2019-12203
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-12203
8
reference_url https://www.silverstripe.org/download/security-releases/cve-2019-12203/
reference_id CVE-2019-12203
reference_type
scores
url https://www.silverstripe.org/download/security-releases/cve-2019-12203/
9
reference_url https://www.silverstripe.org/download/security-releases/CVE-2019-12203
reference_id CVE-2019-12203
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2019-12203
10
reference_url https://github.com/advisories/GHSA-w7r7-r8r9-vrg2
reference_id GHSA-w7r7-r8r9-vrg2
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-w7r7-r8r9-vrg2
fixed_packages
0
url pkg:composer/silverstripe/framework@3.6.8
purl pkg:composer/silverstripe/framework@3.6.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-pkve-yjqy-syc2
19
vulnerability VCID-qmfy-dxag-uuex
20
vulnerability VCID-r1eg-dwej-5kau
21
vulnerability VCID-tv7h-289s-xub4
22
vulnerability VCID-u9e7-1zhg-mygt
23
vulnerability VCID-umhc-fdfh-1fdx
24
vulnerability VCID-uy47-3s8a-hbdn
25
vulnerability VCID-wgdv-etcq-3qhw
26
vulnerability VCID-xg74-3h1h-kqaf
27
vulnerability VCID-y8et-m846-2fc6
28
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.6.8
1
url pkg:composer/silverstripe/framework@3.7.4
purl pkg:composer/silverstripe/framework@3.7.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-pkve-yjqy-syc2
19
vulnerability VCID-qmfy-dxag-uuex
20
vulnerability VCID-r1eg-dwej-5kau
21
vulnerability VCID-tv7h-289s-xub4
22
vulnerability VCID-umhc-fdfh-1fdx
23
vulnerability VCID-uy47-3s8a-hbdn
24
vulnerability VCID-wgdv-etcq-3qhw
25
vulnerability VCID-xg74-3h1h-kqaf
26
vulnerability VCID-y8et-m846-2fc6
27
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.7.4
2
url pkg:composer/silverstripe/framework@4.3.4
purl pkg:composer/silverstripe/framework@4.3.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-nzcm-xbxx-wyf9
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.4
3
url pkg:composer/silverstripe/framework@4.3.5
purl pkg:composer/silverstripe/framework@4.3.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-pkve-yjqy-syc2
21
vulnerability VCID-qmfy-dxag-uuex
22
vulnerability VCID-ru3j-21j8-ayhm
23
vulnerability VCID-tv7h-289s-xub4
24
vulnerability VCID-uy47-3s8a-hbdn
25
vulnerability VCID-wgdv-etcq-3qhw
26
vulnerability VCID-xm4q-u96p-57dd
27
vulnerability VCID-ytbc-8mhd-b3fc
28
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.5
4
url pkg:composer/silverstripe/framework@4.4.4
purl pkg:composer/silverstripe/framework@4.4.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-5dt7-nc8t-nqgh
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7gak-15m5-j3f5
8
vulnerability VCID-7w7t-3783-1kbs
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9t4k-8hsz-bfdw
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-ca4q-xd4v-vqfe
15
vulnerability VCID-fmfu-81xu-pfdy
16
vulnerability VCID-gnpw-s9hp-wqfs
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-k46z-g6jp-57ek
19
vulnerability VCID-ky21-z2d2-sye6
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.4.4
aliases CVE-2019-12203, GHSA-w7r7-r8r9-vrg2
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cmwn-cjff-9qau
22
url VCID-czh2-w6fk-xqd6
vulnerability_id VCID-czh2-w6fk-xqd6
summary 
silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`
After performing a password reset, `ChangePasswordForm::doChangePassword()` logs in the user without checking `Member::canLogIn()`. This presents an issue for sites that are using the extension point in that method to deny access to users (for example members that have not been “approved”, or members that have had their access revoked temporarily). It looks like `Member::canLogIn()` was originally designed to only be used for checking whether the user is locked out (due to too many incorrect login attempts) but has been opened up to other uses.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-011-1.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-011-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/2b30ade44d333a4da4d13b31ffa28d0a34597442
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/2b30ade44d333a4da4d13b31ffa28d0a34597442
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/6606d986634f5b5dec16462acaa8d9a513c29fec
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/6606d986634f5b5dec16462acaa8d9a513c29fec
4
reference_url https://github.com/silverstripe/silverstripe-framework/commit/6d41db77fa78f473db7bcff389456c980ef4e412
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/6d41db77fa78f473db7bcff389456c980ef4e412
5
reference_url https://github.com/silverstripe/silverstripe-framework/commit/782c18fd13b9fb92707d0ea3b231023204928297
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/782c18fd13b9fb92707d0ea3b231023204928297
6
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-011
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-011
7
reference_url https://github.com/advisories/GHSA-p5h2-vr99-xm99
reference_id GHSA-p5h2-vr99-xm99
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-p5h2-vr99-xm99
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
aliases GHSA-p5h2-vr99-xm99
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-czh2-w6fk-xqd6
23
url VCID-ewg1-jqza-eyez
vulnerability_id VCID-ewg1-jqza-eyez
summary 
Member.Name isn't escaped
The core template `framework/templates/Includes/GridField_print.ss` uses "Printed by $Member.Name". If the currently logged in members first name or surname contain XSS, this prints the raw HTML out, because `Member->getName()` just returns the raw `FirstName + Surname` as a string, which is injected directly.
references
0
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-013/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2016-013/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
3
url pkg:composer/silverstripe/framework@4.0.0-alpha1
purl pkg:composer/silverstripe/framework@4.0.0-alpha1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-qmfy-dxag-uuex
19
vulnerability VCID-r1eg-dwej-5kau
20
vulnerability VCID-tv7h-289s-xub4
21
vulnerability VCID-uy47-3s8a-hbdn
22
vulnerability VCID-wgdv-etcq-3qhw
23
vulnerability VCID-xg74-3h1h-kqaf
24
vulnerability VCID-y8et-m846-2fc6
25
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.0-alpha1
aliases SS-2016-013
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ewg1-jqza-eyez
24
url VCID-gkkp-9fm7-jfaz
vulnerability_id VCID-gkkp-9fm7-jfaz
summary 
Missing ACL on reports
The `SS_Report`, and the reports CMS section only checks `canView()` when listing the reports that can be viewed by the current user. It does not (and should) perform `canView` checks when the report is actually viewed, so if you know the URL to a report and can otherwise access the Reports section of the CMS, you can view any report.
references
0
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-012/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2016-012/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
3
url pkg:composer/silverstripe/framework@4.0.0-alpha1
purl pkg:composer/silverstripe/framework@4.0.0-alpha1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-qmfy-dxag-uuex
19
vulnerability VCID-r1eg-dwej-5kau
20
vulnerability VCID-tv7h-289s-xub4
21
vulnerability VCID-uy47-3s8a-hbdn
22
vulnerability VCID-wgdv-etcq-3qhw
23
vulnerability VCID-xg74-3h1h-kqaf
24
vulnerability VCID-y8et-m846-2fc6
25
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.0-alpha1
aliases SS-2016-012
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gkkp-9fm7-jfaz
25
url VCID-gnpw-s9hp-wqfs
vulnerability_id VCID-gnpw-s9hp-wqfs
summary 
Improper Input Validation
Silverstripe Framework is the MVC framework that powers Silverstripe CMS. When a new member record is created and a password is not set, an empty encrypted password is generated. As a result, if someone is aware of the existence of a member record associated with a specific email address, they can potentially attempt to log in using that empty password. Although the default member authenticator and login form require a non-empty password, alternative authentication methods might still permit a successful login with the empty password. This issue has been patched in versions 4.13.4 and 5.0.13.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-32302.yaml
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-32302.yaml
1
reference_url https://github.com/github/advisory-database/pull/2575
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/github/advisory-database/pull/2575
2
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/7b21b38ac4532d06565dfcefad50540ebd2b50f4
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/7b21b38ac4532d06565dfcefad50540ebd2b50f4
4
reference_url https://github.com/silverstripe/silverstripe-framework/releases/tag/4.13.14
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/releases/tag/4.13.14
5
reference_url https://github.com/silverstripe/silverstripe-framework/releases/tag/5.0.13
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/releases/tag/5.0.13
6
reference_url https://www.silverstripe.org/download/security-releases/CVE-2023-32302
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2023-32302
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-32302
reference_id CVE-2023-32302
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-32302
8
reference_url https://github.com/advisories/GHSA-36xx-7vf6-7mv3
reference_id GHSA-36xx-7vf6-7mv3
reference_type
scores
url https://github.com/advisories/GHSA-36xx-7vf6-7mv3
9
reference_url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-36xx-7vf6-7mv3
reference_id GHSA-36xx-7vf6-7mv3
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-36xx-7vf6-7mv3
fixed_packages
0
url pkg:composer/silverstripe/framework@4.13.14
purl pkg:composer/silverstripe/framework@4.13.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-86vg-4j71-hkgr
5
vulnerability VCID-8u5c-6vx3-mfcr
6
vulnerability VCID-9y5u-qyzd-3ud9
7
vulnerability VCID-k46z-g6jp-57ek
8
vulnerability VCID-ky21-z2d2-sye6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.13.14
1
url pkg:composer/silverstripe/framework@5.0.13
purl pkg:composer/silverstripe/framework@5.0.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-86vg-4j71-hkgr
5
vulnerability VCID-8u5c-6vx3-mfcr
6
vulnerability VCID-9y5u-qyzd-3ud9
7
vulnerability VCID-k46z-g6jp-57ek
8
vulnerability VCID-ky21-z2d2-sye6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@5.0.13
aliases CVE-2023-32302, GHSA-36xx-7vf6-7mv3
risk_score 1.4
exploitability 0.5
weighted_severity 2.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gnpw-s9hp-wqfs
26
url VCID-hcuz-gz3w-97ew
vulnerability_id VCID-hcuz-gz3w-97ew
summary Business Logic Errors in GitHub repository silverstripe/silverstripe-framework
references
0
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
1
reference_url https://github.com/silverstripe/silverstripe-framework/commit/cbf2987a616e9ef4d7eccae5d763ef2179bdbcc2
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/cbf2987a616e9ef4d7eccae5d763ef2179bdbcc2
2
reference_url https://huntr.dev/bounties/35631e3a-f4b9-41ad-857c-7e3021932a72
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://huntr.dev/bounties/35631e3a-f4b9-41ad-857c-7e3021932a72
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-0227
reference_id CVE-2022-0227
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-0227
4
reference_url https://github.com/advisories/GHSA-32m2-9f76-4gv8
reference_id GHSA-32m2-9f76-4gv8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-32m2-9f76-4gv8
fixed_packages
0
url pkg:composer/silverstripe/framework@4.10.1
purl pkg:composer/silverstripe/framework@4.10.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-k46z-g6jp-57ek
17
vulnerability VCID-ky21-z2d2-sye6
18
vulnerability VCID-uy47-3s8a-hbdn
19
vulnerability VCID-xm4q-u96p-57dd
20
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.10.1
aliases CVE-2022-0227, GHSA-32m2-9f76-4gv8
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hcuz-gz3w-97ew
27
url VCID-hnme-cqff-c7dp
vulnerability_id VCID-hnme-cqff-c7dp
summary 
ReadOnly transformation for formfields exploitable
Form fields returning `isReadonly()` as true are vulnerable to reflected XSS injections. This includes `ReadonlyField`, `LookupField`, `HTMLReadonlyField`, as well as special purpose fields like `TimeField_Readonly`. Values submitted to through these form fields are not filtered out from the form session data, and might be shown to the user depending on the form behaviour. For example, form validation errors cause the form to re-render with previously submitted values by default. SilverStripe forms automatically load values from request data (GET and POST), which enables malicious use of URLs if your form uses these fields and does not overwrite data on form construction. Readonly and disabled form fields are already filtered out in `saveInto()`, so maliciously submitted data on these fields does not make it into the database unless you are accessing form values directly in your saving logic.
references
0
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-010/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2016-010/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.6
purl pkg:composer/silverstripe/framework@3.2.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3x46-q9cb-7ubg
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-b6nm-cphj-wfgw
12
vulnerability VCID-b95v-49p7-fkas
13
vulnerability VCID-c6bz-jwhm-vkgp
14
vulnerability VCID-cmwn-cjff-9qau
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-mkex-ht2r-cucz
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-nute-ndg2-z7ev
22
vulnerability VCID-pkve-yjqy-syc2
23
vulnerability VCID-qdwg-f2bx-1bay
24
vulnerability VCID-qmfy-dxag-uuex
25
vulnerability VCID-r1eg-dwej-5kau
26
vulnerability VCID-sg62-98yy-2kd7
27
vulnerability VCID-t81f-5b8z-hyht
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-umhc-fdfh-1fdx
30
vulnerability VCID-uy47-3s8a-hbdn
31
vulnerability VCID-wgdv-etcq-3qhw
32
vulnerability VCID-xg74-3h1h-kqaf
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.6
1
url pkg:composer/silverstripe/framework@3.3.4
purl pkg:composer/silverstripe/framework@3.3.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3x46-q9cb-7ubg
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-b6nm-cphj-wfgw
12
vulnerability VCID-b95v-49p7-fkas
13
vulnerability VCID-c6bz-jwhm-vkgp
14
vulnerability VCID-cmwn-cjff-9qau
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-mkex-ht2r-cucz
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-nute-ndg2-z7ev
22
vulnerability VCID-pkve-yjqy-syc2
23
vulnerability VCID-qdwg-f2bx-1bay
24
vulnerability VCID-qmfy-dxag-uuex
25
vulnerability VCID-r1eg-dwej-5kau
26
vulnerability VCID-sg62-98yy-2kd7
27
vulnerability VCID-t81f-5b8z-hyht
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-umhc-fdfh-1fdx
30
vulnerability VCID-uy47-3s8a-hbdn
31
vulnerability VCID-wgdv-etcq-3qhw
32
vulnerability VCID-xg74-3h1h-kqaf
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.4
2
url pkg:composer/silverstripe/framework@3.4.2
purl pkg:composer/silverstripe/framework@3.4.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3j6f-5c14-uubc
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4qjj-wqg5-dbay
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7hxq-cp29-r7dh
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-bwrh-updj-zkfs
16
vulnerability VCID-c6bz-jwhm-vkgp
17
vulnerability VCID-cmwn-cjff-9qau
18
vulnerability VCID-gnpw-s9hp-wqfs
19
vulnerability VCID-hcuz-gz3w-97ew
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-njph-ua7r-auaq
25
vulnerability VCID-nute-ndg2-z7ev
26
vulnerability VCID-pkve-yjqy-syc2
27
vulnerability VCID-qdwg-f2bx-1bay
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.2
aliases SS-2016-010
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hnme-cqff-c7dp
28
url VCID-k46z-g6jp-57ek
vulnerability_id VCID-k46z-g6jp-57ek
summary 
Silverstripe uses TinyMCE which allows svg files linked in object tags
TinyMCE v6 has a configuration value `convert_unsafe_embeds` set to `false` which allows svg files containing javascript to be used in `<object>` or `<embed>` tags, which can be used as a vector for XSS attacks.

Note that `<embed>` tags are not allowed by default.

After patching the default value of `convert_unsafe_embeds` will be set to `true`. This means that `<object>` tags will be converted to iframes instead the next time the page is saved, which may break any pages that rely upon previously saved `<object>` tags. Developers can override this configuration if desired to revert to the original behaviour.

We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2024-001.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2024-001.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://www.silverstripe.org/download/security-releases/ss-2024-001
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2024-001
3
reference_url https://github.com/advisories/GHSA-52cw-pvq9-9m5v
reference_id GHSA-52cw-pvq9-9m5v
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-52cw-pvq9-9m5v
4
reference_url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-52cw-pvq9-9m5v
reference_id GHSA-52cw-pvq9-9m5v
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-52cw-pvq9-9m5v
5
reference_url https://github.com/advisories/GHSA-5359-pvf2-pw78
reference_id GHSA-5359-pvf2-pw78
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-5359-pvf2-pw78
fixed_packages
0
url pkg:composer/silverstripe/framework@5.2.16
purl pkg:composer/silverstripe/framework@5.2.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-86vg-4j71-hkgr
5
vulnerability VCID-8u5c-6vx3-mfcr
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@5.2.16
aliases GHSA-52cw-pvq9-9m5v
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-k46z-g6jp-57ek
29
url VCID-ky21-z2d2-sye6
vulnerability_id VCID-ky21-z2d2-sye6
summary 
Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload
A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it.

The server-side sanitisation logic has been updated to sanitise against this type of attack.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-32981
reference_id
reference_type
scores
0
value 0.0105
scoring_system epss
scoring_elements 0.7791
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-32981
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/b8d20dc9d531550e06fd7da7a0eafa551922e2e1
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-18T13:18:39Z/
url https://github.com/silverstripe/silverstripe-framework/commit/b8d20dc9d531550e06fd7da7a0eafa551922e2e1
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-32981
reference_id CVE-2024-32981
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-32981
4
reference_url https://www.silverstripe.org/download/security-releases/cve-2024-32981
reference_id CVE-2024-32981
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-18T13:18:39Z/
url https://www.silverstripe.org/download/security-releases/cve-2024-32981
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-32981.yaml
reference_id CVE-2024-32981.YAML
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-32981.yaml
6
reference_url https://github.com/advisories/GHSA-chx7-9x8h-r5mg
reference_id GHSA-chx7-9x8h-r5mg
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-chx7-9x8h-r5mg
7
reference_url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-chx7-9x8h-r5mg
reference_id GHSA-chx7-9x8h-r5mg
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-18T13:18:39Z/
url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-chx7-9x8h-r5mg
fixed_packages
0
url pkg:composer/silverstripe/framework@5.2.16
purl pkg:composer/silverstripe/framework@5.2.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-86vg-4j71-hkgr
5
vulnerability VCID-8u5c-6vx3-mfcr
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@5.2.16
aliases CVE-2024-32981, GHSA-chx7-9x8h-r5mg
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ky21-z2d2-sye6
30
url VCID-mkex-ht2r-cucz
vulnerability_id VCID-mkex-ht2r-cucz
summary 
Files or Directories Accessible to External Parties
In SilverStripe, there is broken access control on files.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-14273
reference_id
reference_type
scores
0
value 0.00336
scoring_system epss
scoring_elements 0.56702
published_at 2026-06-04T12:55:00Z
1
value 0.00336
scoring_system epss
scoring_elements 0.56754
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-14273
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/FriendsOfPHP/security-advisories
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-14273.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-14273.yaml
4
reference_url https://www.silverstripe.org/blog/tag/release
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/blog/tag/release
5
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
6
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-14273
reference_id CVE-2019-14273
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-14273
8
reference_url https://www.silverstripe.org/download/security-releases/CVE-2019-14273
reference_id CVE-2019-14273
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2019-14273
9
reference_url https://github.com/advisories/GHSA-43jj-2rwc-2m3f
reference_id GHSA-43jj-2rwc-2m3f
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-43jj-2rwc-2m3f
fixed_packages
0
url pkg:composer/silverstripe/framework@4.0.1-rc1
purl pkg:composer/silverstripe/framework@4.0.1-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-24a5-ruc4-bycq
4
vulnerability VCID-2hk2-hzyh-wbhf
5
vulnerability VCID-37d1-tt74-yyfm
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7gak-15m5-j3f5
9
vulnerability VCID-7w7t-3783-1kbs
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9t4k-8hsz-bfdw
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a1p9-cwzb-kbgb
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-aj7q-x4hc-xbdm
17
vulnerability VCID-aygc-4nhm-n7eq
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-ca4q-xd4v-vqfe
20
vulnerability VCID-cmwn-cjff-9qau
21
vulnerability VCID-fm87-te3v-pkc8
22
vulnerability VCID-fmfu-81xu-pfdy
23
vulnerability VCID-g7kn-gn2m-myc3
24
vulnerability VCID-gnpw-s9hp-wqfs
25
vulnerability VCID-h9g1-7wez-8qft
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hq36-9ntc-akez
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-m3us-9sft-wbh8
31
vulnerability VCID-n4fk-735u-2baw
32
vulnerability VCID-nute-ndg2-z7ev
33
vulnerability VCID-nzcm-xbxx-wyf9
34
vulnerability VCID-p2m9-rejx-e3e9
35
vulnerability VCID-pkve-yjqy-syc2
36
vulnerability VCID-qmfy-dxag-uuex
37
vulnerability VCID-r1eg-dwej-5kau
38
vulnerability VCID-ru3j-21j8-ayhm
39
vulnerability VCID-tsdn-bu3d-ubaf
40
vulnerability VCID-tv7h-289s-xub4
41
vulnerability VCID-uy47-3s8a-hbdn
42
vulnerability VCID-wgdv-etcq-3qhw
43
vulnerability VCID-xg74-3h1h-kqaf
44
vulnerability VCID-xm4q-u96p-57dd
45
vulnerability VCID-y8et-m846-2fc6
46
vulnerability VCID-ytbc-8mhd-b3fc
47
vulnerability VCID-yxuh-bxh5-z3cw
48
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.1-rc1
1
url pkg:composer/silverstripe/framework@4.0.1
purl pkg:composer/silverstripe/framework@4.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-24a5-ruc4-bycq
4
vulnerability VCID-2hk2-hzyh-wbhf
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7gak-15m5-j3f5
8
vulnerability VCID-7w7t-3783-1kbs
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9t4k-8hsz-bfdw
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-aj7q-x4hc-xbdm
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-ca4q-xd4v-vqfe
17
vulnerability VCID-cmwn-cjff-9qau
18
vulnerability VCID-fmfu-81xu-pfdy
19
vulnerability VCID-g7kn-gn2m-myc3
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-h9g1-7wez-8qft
22
vulnerability VCID-hcuz-gz3w-97ew
23
vulnerability VCID-hq36-9ntc-akez
24
vulnerability VCID-k46z-g6jp-57ek
25
vulnerability VCID-ky21-z2d2-sye6
26
vulnerability VCID-m3us-9sft-wbh8
27
vulnerability VCID-n4fk-735u-2baw
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-nzcm-xbxx-wyf9
30
vulnerability VCID-p2m9-rejx-e3e9
31
vulnerability VCID-pkve-yjqy-syc2
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-ru3j-21j8-ayhm
35
vulnerability VCID-tsdn-bu3d-ubaf
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-uy47-3s8a-hbdn
38
vulnerability VCID-wgdv-etcq-3qhw
39
vulnerability VCID-xg74-3h1h-kqaf
40
vulnerability VCID-xm4q-u96p-57dd
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-ytbc-8mhd-b3fc
43
vulnerability VCID-yxuh-bxh5-z3cw
44
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.1
2
url pkg:composer/silverstripe/framework@4.3.5
purl pkg:composer/silverstripe/framework@4.3.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-pkve-yjqy-syc2
21
vulnerability VCID-qmfy-dxag-uuex
22
vulnerability VCID-ru3j-21j8-ayhm
23
vulnerability VCID-tv7h-289s-xub4
24
vulnerability VCID-uy47-3s8a-hbdn
25
vulnerability VCID-wgdv-etcq-3qhw
26
vulnerability VCID-xm4q-u96p-57dd
27
vulnerability VCID-ytbc-8mhd-b3fc
28
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.5
3
url pkg:composer/silverstripe/framework@4.4.4
purl pkg:composer/silverstripe/framework@4.4.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-5dt7-nc8t-nqgh
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7gak-15m5-j3f5
8
vulnerability VCID-7w7t-3783-1kbs
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9t4k-8hsz-bfdw
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-ca4q-xd4v-vqfe
15
vulnerability VCID-fmfu-81xu-pfdy
16
vulnerability VCID-gnpw-s9hp-wqfs
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-k46z-g6jp-57ek
19
vulnerability VCID-ky21-z2d2-sye6
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.4.4
aliases CVE-2019-14273, GHSA-43jj-2rwc-2m3f
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mkex-ht2r-cucz
31
url VCID-n1mj-u4yk-jqhn
vulnerability_id VCID-n1mj-u4yk-jqhn
summary 
silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField`
List of key / value pairs assigned to `OptionsetField` or `CheckboxSetField` do not have a default casting assigned to them. The effect of this is a potential XSS vulnerability in lists where either key or value contain unescaped HTML.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-015-1.yaml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-015-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/049cdefacfd3122d59d5488c1317f999fe8aacc4
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/049cdefacfd3122d59d5488c1317f999fe8aacc4
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/12a6b357e761f09d818fd0013eb2d85014de79a0
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/12a6b357e761f09d818fd0013eb2d85014de79a0
4
reference_url https://github.com/silverstripe/silverstripe-framework/commit/62a242154ec3508fe9b174a40713c8520ac1684c
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/62a242154ec3508fe9b174a40713c8520ac1684c
5
reference_url https://github.com/silverstripe/silverstripe-framework/commit/b0ba2015d9684ee7b124dafcf6b59b046e20f8ed
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/b0ba2015d9684ee7b124dafcf6b59b046e20f8ed
6
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-015
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-015
7
reference_url https://github.com/advisories/GHSA-468j-6jrc-2rjx
reference_id GHSA-468j-6jrc-2rjx
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-468j-6jrc-2rjx
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
aliases GHSA-468j-6jrc-2rjx
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n1mj-u4yk-jqhn
32
url VCID-n4fk-735u-2baw
vulnerability_id VCID-n4fk-735u-2baw
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
SilverStripe Framework suffers from a XSS vulnerablity.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-36150
reference_id
reference_type
scores
0
value 0.00372
scoring_system epss
scoring_elements 0.5931
published_at 2026-06-05T12:55:00Z
1
value 0.00372
scoring_system epss
scoring_elements 0.5926
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-36150
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/admin/CVE-2021-36150.yaml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/admin/CVE-2021-36150.yaml
2
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
3
reference_url https://github.com/silverstripe/silverstripe-framework/releases
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/releases
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-36150
reference_id CVE-2021-36150
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-36150
5
reference_url https://www.silverstripe.org/download/security-releases/CVE-2021-36150
reference_id CVE-2021-36150
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2021-36150
6
reference_url https://github.com/advisories/GHSA-j66h-cc96-c32q
reference_id GHSA-j66h-cc96-c32q
reference_type
scores
url https://github.com/advisories/GHSA-j66h-cc96-c32q
fixed_packages
0
url pkg:composer/silverstripe/framework@4.9.0-alpha1
purl pkg:composer/silverstripe/framework@4.9.0-alpha1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-uy47-3s8a-hbdn
20
vulnerability VCID-xm4q-u96p-57dd
21
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.9.0-alpha1
1
url pkg:composer/silverstripe/framework@4.9.0
purl pkg:composer/silverstripe/framework@4.9.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-uy47-3s8a-hbdn
20
vulnerability VCID-xm4q-u96p-57dd
21
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.9.0
aliases CVE-2021-36150, GHSA-j66h-cc96-c32q
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n4fk-735u-2baw
33
url VCID-nute-ndg2-z7ev
vulnerability_id VCID-nute-ndg2-z7ev
summary 
Cross-site Scripting
SilverStripe has Flash Clipboard Reflected XSS.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-12205
reference_id
reference_type
scores
0
value 0.00378
scoring_system epss
scoring_elements 0.59631
published_at 2026-06-04T12:55:00Z
1
value 0.00378
scoring_system epss
scoring_elements 0.59681
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-12205
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12205.yaml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12205.yaml
3
reference_url https://github.com/silverstripe/silverstripe-admin/commit/6e6fa5c618b9dbf4cc0a56704834bfa1d5b0d18e
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-admin/commit/6e6fa5c618b9dbf4cc0a56704834bfa1d5b0d18e
4
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
5
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
6
reference_url https://www.silverstripe.org/download/security-releases/cve-2019-12205
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2019-12205
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-12205
reference_id CVE-2019-12205
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-12205
8
reference_url https://www.silverstripe.org/download/security-releases/CVE-2019-12205
reference_id CVE-2019-12205
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2019-12205
9
reference_url https://github.com/advisories/GHSA-rfvw-5848-gxc5
reference_id GHSA-rfvw-5848-gxc5
reference_type
scores
url https://github.com/advisories/GHSA-rfvw-5848-gxc5
fixed_packages
0
url pkg:composer/silverstripe/framework@4.3.4
purl pkg:composer/silverstripe/framework@4.3.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-nzcm-xbxx-wyf9
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.4
1
url pkg:composer/silverstripe/framework@4.3.5
purl pkg:composer/silverstripe/framework@4.3.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-pkve-yjqy-syc2
21
vulnerability VCID-qmfy-dxag-uuex
22
vulnerability VCID-ru3j-21j8-ayhm
23
vulnerability VCID-tv7h-289s-xub4
24
vulnerability VCID-uy47-3s8a-hbdn
25
vulnerability VCID-wgdv-etcq-3qhw
26
vulnerability VCID-xm4q-u96p-57dd
27
vulnerability VCID-ytbc-8mhd-b3fc
28
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.5
2
url pkg:composer/silverstripe/framework@4.4.4
purl pkg:composer/silverstripe/framework@4.4.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-5dt7-nc8t-nqgh
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7gak-15m5-j3f5
8
vulnerability VCID-7w7t-3783-1kbs
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9t4k-8hsz-bfdw
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-ca4q-xd4v-vqfe
15
vulnerability VCID-fmfu-81xu-pfdy
16
vulnerability VCID-gnpw-s9hp-wqfs
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-k46z-g6jp-57ek
19
vulnerability VCID-ky21-z2d2-sye6
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.4.4
aliases CVE-2019-12205, GHSA-rfvw-5848-gxc5
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nute-ndg2-z7ev
34
url VCID-pkve-yjqy-syc2
vulnerability_id VCID-pkve-yjqy-syc2
summary 
SilverStripe Web Cache Poisoning through HTTPRequestBuilder
SilverStripe through 4.4.4 allows Web Cache Poisoning through HTTPRequestBuilder.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-19326
reference_id
reference_type
scores
0
value 0.00209
scoring_system epss
scoring_elements 0.43423
published_at 2026-06-05T12:55:00Z
1
value 0.00209
scoring_system epss
scoring_elements 0.4335
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-19326
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-19326.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-19326.yaml
2
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/107706c12cd9cf4d1b8b96b6a6e223633209d851
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/107706c12cd9cf4d1b8b96b6a6e223633209d851
4
reference_url https://github.com/silverstripe/silverstripe-framework/commit/8518987cbd1eaca71b65dd4a4b35591db941509a
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/8518987cbd1eaca71b65dd4a4b35591db941509a
5
reference_url https://github.com/silverstripe/silverstripe-framework/commit/98926e4e6c26d1d43bb1faf516d15bdb2739556e
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/98926e4e6c26d1d43bb1faf516d15bdb2739556e
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-19326
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-19326
7
reference_url https://www.silverstripe.org/download/security-releases/CVE-2019-19326
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2019-19326
8
reference_url https://github.com/advisories/GHSA-q9ff-3q93-fm8m
reference_id GHSA-q9ff-3q93-fm8m
reference_type
scores
url https://github.com/advisories/GHSA-q9ff-3q93-fm8m
fixed_packages
0
url pkg:composer/silverstripe/framework@3.7.5
purl pkg:composer/silverstripe/framework@3.7.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-86vg-4j71-hkgr
5
vulnerability VCID-8u5c-6vx3-mfcr
6
vulnerability VCID-9y5u-qyzd-3ud9
7
vulnerability VCID-a7cf-kpzy-xudd
8
vulnerability VCID-gnpw-s9hp-wqfs
9
vulnerability VCID-hcuz-gz3w-97ew
10
vulnerability VCID-k46z-g6jp-57ek
11
vulnerability VCID-ky21-z2d2-sye6
12
vulnerability VCID-n4fk-735u-2baw
13
vulnerability VCID-qmfy-dxag-uuex
14
vulnerability VCID-tv7h-289s-xub4
15
vulnerability VCID-uy47-3s8a-hbdn
16
vulnerability VCID-wgdv-etcq-3qhw
17
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.7.5
1
url pkg:composer/silverstripe/framework@4.4.7
purl pkg:composer/silverstripe/framework@4.4.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-qmfy-dxag-uuex
21
vulnerability VCID-tv7h-289s-xub4
22
vulnerability VCID-uy47-3s8a-hbdn
23
vulnerability VCID-wgdv-etcq-3qhw
24
vulnerability VCID-xm4q-u96p-57dd
25
vulnerability VCID-ytbc-8mhd-b3fc
26
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.4.7
2
url pkg:composer/silverstripe/framework@4.5.4
purl pkg:composer/silverstripe/framework@4.5.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-qmfy-dxag-uuex
21
vulnerability VCID-tv7h-289s-xub4
22
vulnerability VCID-uy47-3s8a-hbdn
23
vulnerability VCID-wgdv-etcq-3qhw
24
vulnerability VCID-xm4q-u96p-57dd
25
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.5.4
aliases CVE-2019-19326, GHSA-q9ff-3q93-fm8m
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pkve-yjqy-syc2
35
url VCID-qdwg-f2bx-1bay
vulnerability_id VCID-qdwg-f2bx-1bay
summary 
Injection Vulnerability
In the CSV export feature of SilverStripe, it is possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-18049
reference_id
reference_type
scores
0
value 0.00212
scoring_system epss
scoring_elements 0.43781
published_at 2026-06-05T12:55:00Z
1
value 0.00212
scoring_system epss
scoring_elements 0.43711
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-18049
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://www.exploit-db.com/exploits/43396
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.exploit-db.com/exploits/43396
3
reference_url https://www.exploit-db.com/exploits/43396/
reference_id
reference_type
scores
url https://www.exploit-db.com/exploits/43396/
4
reference_url https://www.silverstripe.org/download/security-releases/ss-2017-007
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2017-007
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-18049
reference_id CVE-2017-18049
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-18049
fixed_packages
0
url pkg:composer/silverstripe/framework@3.5.6-rc1
purl pkg:composer/silverstripe/framework@3.5.6-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-aygc-4nhm-n7eq
12
vulnerability VCID-b6nm-cphj-wfgw
13
vulnerability VCID-cmwn-cjff-9qau
14
vulnerability VCID-fm87-te3v-pkc8
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-mkex-ht2r-cucz
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-nute-ndg2-z7ev
22
vulnerability VCID-pkve-yjqy-syc2
23
vulnerability VCID-qmfy-dxag-uuex
24
vulnerability VCID-r1eg-dwej-5kau
25
vulnerability VCID-tv7h-289s-xub4
26
vulnerability VCID-u9e7-1zhg-mygt
27
vulnerability VCID-umhc-fdfh-1fdx
28
vulnerability VCID-uy47-3s8a-hbdn
29
vulnerability VCID-wgdv-etcq-3qhw
30
vulnerability VCID-xg74-3h1h-kqaf
31
vulnerability VCID-y8et-m846-2fc6
32
vulnerability VCID-zdge-zsmz-8ud9
33
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.5.6-rc1
1
url pkg:composer/silverstripe/framework@3.5.6
purl pkg:composer/silverstripe/framework@3.5.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-5cfa-whq6-9ucp
4
vulnerability VCID-79qx-v5uu-jyf2
5
vulnerability VCID-7hxq-cp29-r7dh
6
vulnerability VCID-86vg-4j71-hkgr
7
vulnerability VCID-8u5c-6vx3-mfcr
8
vulnerability VCID-9y5u-qyzd-3ud9
9
vulnerability VCID-a7cf-kpzy-xudd
10
vulnerability VCID-b6nm-cphj-wfgw
11
vulnerability VCID-cmwn-cjff-9qau
12
vulnerability VCID-gnpw-s9hp-wqfs
13
vulnerability VCID-hcuz-gz3w-97ew
14
vulnerability VCID-k46z-g6jp-57ek
15
vulnerability VCID-ky21-z2d2-sye6
16
vulnerability VCID-mkex-ht2r-cucz
17
vulnerability VCID-n4fk-735u-2baw
18
vulnerability VCID-nute-ndg2-z7ev
19
vulnerability VCID-pkve-yjqy-syc2
20
vulnerability VCID-qmfy-dxag-uuex
21
vulnerability VCID-r1eg-dwej-5kau
22
vulnerability VCID-tv7h-289s-xub4
23
vulnerability VCID-u9e7-1zhg-mygt
24
vulnerability VCID-umhc-fdfh-1fdx
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xg74-3h1h-kqaf
28
vulnerability VCID-y8et-m846-2fc6
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.5.6
2
url pkg:composer/silverstripe/framework@3.6.3-rc2
purl pkg:composer/silverstripe/framework@3.6.3-rc2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-aygc-4nhm-n7eq
12
vulnerability VCID-b6nm-cphj-wfgw
13
vulnerability VCID-cmwn-cjff-9qau
14
vulnerability VCID-fm87-te3v-pkc8
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-hq36-9ntc-akez
18
vulnerability VCID-k46z-g6jp-57ek
19
vulnerability VCID-ky21-z2d2-sye6
20
vulnerability VCID-mkex-ht2r-cucz
21
vulnerability VCID-n4fk-735u-2baw
22
vulnerability VCID-nute-ndg2-z7ev
23
vulnerability VCID-pkve-yjqy-syc2
24
vulnerability VCID-qmfy-dxag-uuex
25
vulnerability VCID-r1eg-dwej-5kau
26
vulnerability VCID-tv7h-289s-xub4
27
vulnerability VCID-u9e7-1zhg-mygt
28
vulnerability VCID-umhc-fdfh-1fdx
29
vulnerability VCID-uy47-3s8a-hbdn
30
vulnerability VCID-wgdv-etcq-3qhw
31
vulnerability VCID-xg74-3h1h-kqaf
32
vulnerability VCID-y8et-m846-2fc6
33
vulnerability VCID-zdge-zsmz-8ud9
34
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.6.3-rc2
3
url pkg:composer/silverstripe/framework@3.6.3
purl pkg:composer/silverstripe/framework@3.6.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-5cfa-whq6-9ucp
4
vulnerability VCID-79qx-v5uu-jyf2
5
vulnerability VCID-7hxq-cp29-r7dh
6
vulnerability VCID-86vg-4j71-hkgr
7
vulnerability VCID-8u5c-6vx3-mfcr
8
vulnerability VCID-9y5u-qyzd-3ud9
9
vulnerability VCID-a7cf-kpzy-xudd
10
vulnerability VCID-b6nm-cphj-wfgw
11
vulnerability VCID-cmwn-cjff-9qau
12
vulnerability VCID-gnpw-s9hp-wqfs
13
vulnerability VCID-hcuz-gz3w-97ew
14
vulnerability VCID-hq36-9ntc-akez
15
vulnerability VCID-k46z-g6jp-57ek
16
vulnerability VCID-ky21-z2d2-sye6
17
vulnerability VCID-mkex-ht2r-cucz
18
vulnerability VCID-n4fk-735u-2baw
19
vulnerability VCID-nute-ndg2-z7ev
20
vulnerability VCID-pkve-yjqy-syc2
21
vulnerability VCID-qmfy-dxag-uuex
22
vulnerability VCID-r1eg-dwej-5kau
23
vulnerability VCID-tv7h-289s-xub4
24
vulnerability VCID-u9e7-1zhg-mygt
25
vulnerability VCID-umhc-fdfh-1fdx
26
vulnerability VCID-uy47-3s8a-hbdn
27
vulnerability VCID-wgdv-etcq-3qhw
28
vulnerability VCID-xg74-3h1h-kqaf
29
vulnerability VCID-y8et-m846-2fc6
30
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.6.3
4
url pkg:composer/silverstripe/framework@4.0.1-rc1
purl pkg:composer/silverstripe/framework@4.0.1-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-24a5-ruc4-bycq
4
vulnerability VCID-2hk2-hzyh-wbhf
5
vulnerability VCID-37d1-tt74-yyfm
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7gak-15m5-j3f5
9
vulnerability VCID-7w7t-3783-1kbs
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9t4k-8hsz-bfdw
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a1p9-cwzb-kbgb
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-aj7q-x4hc-xbdm
17
vulnerability VCID-aygc-4nhm-n7eq
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-ca4q-xd4v-vqfe
20
vulnerability VCID-cmwn-cjff-9qau
21
vulnerability VCID-fm87-te3v-pkc8
22
vulnerability VCID-fmfu-81xu-pfdy
23
vulnerability VCID-g7kn-gn2m-myc3
24
vulnerability VCID-gnpw-s9hp-wqfs
25
vulnerability VCID-h9g1-7wez-8qft
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hq36-9ntc-akez
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-m3us-9sft-wbh8
31
vulnerability VCID-n4fk-735u-2baw
32
vulnerability VCID-nute-ndg2-z7ev
33
vulnerability VCID-nzcm-xbxx-wyf9
34
vulnerability VCID-p2m9-rejx-e3e9
35
vulnerability VCID-pkve-yjqy-syc2
36
vulnerability VCID-qmfy-dxag-uuex
37
vulnerability VCID-r1eg-dwej-5kau
38
vulnerability VCID-ru3j-21j8-ayhm
39
vulnerability VCID-tsdn-bu3d-ubaf
40
vulnerability VCID-tv7h-289s-xub4
41
vulnerability VCID-uy47-3s8a-hbdn
42
vulnerability VCID-wgdv-etcq-3qhw
43
vulnerability VCID-xg74-3h1h-kqaf
44
vulnerability VCID-xm4q-u96p-57dd
45
vulnerability VCID-y8et-m846-2fc6
46
vulnerability VCID-ytbc-8mhd-b3fc
47
vulnerability VCID-yxuh-bxh5-z3cw
48
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.1-rc1
5
url pkg:composer/silverstripe/framework@4.0.1
purl pkg:composer/silverstripe/framework@4.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-24a5-ruc4-bycq
4
vulnerability VCID-2hk2-hzyh-wbhf
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7gak-15m5-j3f5
8
vulnerability VCID-7w7t-3783-1kbs
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9t4k-8hsz-bfdw
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-aj7q-x4hc-xbdm
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-ca4q-xd4v-vqfe
17
vulnerability VCID-cmwn-cjff-9qau
18
vulnerability VCID-fmfu-81xu-pfdy
19
vulnerability VCID-g7kn-gn2m-myc3
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-h9g1-7wez-8qft
22
vulnerability VCID-hcuz-gz3w-97ew
23
vulnerability VCID-hq36-9ntc-akez
24
vulnerability VCID-k46z-g6jp-57ek
25
vulnerability VCID-ky21-z2d2-sye6
26
vulnerability VCID-m3us-9sft-wbh8
27
vulnerability VCID-n4fk-735u-2baw
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-nzcm-xbxx-wyf9
30
vulnerability VCID-p2m9-rejx-e3e9
31
vulnerability VCID-pkve-yjqy-syc2
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-ru3j-21j8-ayhm
35
vulnerability VCID-tsdn-bu3d-ubaf
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-uy47-3s8a-hbdn
38
vulnerability VCID-wgdv-etcq-3qhw
39
vulnerability VCID-xg74-3h1h-kqaf
40
vulnerability VCID-xm4q-u96p-57dd
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-ytbc-8mhd-b3fc
43
vulnerability VCID-yxuh-bxh5-z3cw
44
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.1
aliases CVE-2017-18049, GHSA-2jvj-mhf2-g99w
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qdwg-f2bx-1bay
36
url VCID-qj5k-bcw3-5fgq
vulnerability_id VCID-qj5k-bcw3-5fgq
summary 
silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL
In follow up to [SS-2016-001](https://www.silverstripe.org/download/security-releases/ss-2016-001/) there is yet a minor unresolved fix to incorrectly encoded URL.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-016-1.yaml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-016-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/6b123fe1c93d3ac976f484192abc31cad4f81d47
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/6b123fe1c93d3ac976f484192abc31cad4f81d47
3
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-016
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-016
4
reference_url https://github.com/advisories/GHSA-r85g-7jpv-8xrx
reference_id GHSA-r85g-7jpv-8xrx
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-r85g-7jpv-8xrx
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.6
purl pkg:composer/silverstripe/framework@3.2.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3x46-q9cb-7ubg
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-b6nm-cphj-wfgw
12
vulnerability VCID-b95v-49p7-fkas
13
vulnerability VCID-c6bz-jwhm-vkgp
14
vulnerability VCID-cmwn-cjff-9qau
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-mkex-ht2r-cucz
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-nute-ndg2-z7ev
22
vulnerability VCID-pkve-yjqy-syc2
23
vulnerability VCID-qdwg-f2bx-1bay
24
vulnerability VCID-qmfy-dxag-uuex
25
vulnerability VCID-r1eg-dwej-5kau
26
vulnerability VCID-sg62-98yy-2kd7
27
vulnerability VCID-t81f-5b8z-hyht
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-umhc-fdfh-1fdx
30
vulnerability VCID-uy47-3s8a-hbdn
31
vulnerability VCID-wgdv-etcq-3qhw
32
vulnerability VCID-xg74-3h1h-kqaf
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.6
1
url pkg:composer/silverstripe/framework@3.3.4
purl pkg:composer/silverstripe/framework@3.3.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3x46-q9cb-7ubg
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7hxq-cp29-r7dh
7
vulnerability VCID-86vg-4j71-hkgr
8
vulnerability VCID-8u5c-6vx3-mfcr
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-b6nm-cphj-wfgw
12
vulnerability VCID-b95v-49p7-fkas
13
vulnerability VCID-c6bz-jwhm-vkgp
14
vulnerability VCID-cmwn-cjff-9qau
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-mkex-ht2r-cucz
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-nute-ndg2-z7ev
22
vulnerability VCID-pkve-yjqy-syc2
23
vulnerability VCID-qdwg-f2bx-1bay
24
vulnerability VCID-qmfy-dxag-uuex
25
vulnerability VCID-r1eg-dwej-5kau
26
vulnerability VCID-sg62-98yy-2kd7
27
vulnerability VCID-t81f-5b8z-hyht
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-umhc-fdfh-1fdx
30
vulnerability VCID-uy47-3s8a-hbdn
31
vulnerability VCID-wgdv-etcq-3qhw
32
vulnerability VCID-xg74-3h1h-kqaf
33
vulnerability VCID-y8et-m846-2fc6
34
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.4
2
url pkg:composer/silverstripe/framework@3.4.2
purl pkg:composer/silverstripe/framework@3.4.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3j6f-5c14-uubc
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4qjj-wqg5-dbay
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7hxq-cp29-r7dh
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-bwrh-updj-zkfs
16
vulnerability VCID-c6bz-jwhm-vkgp
17
vulnerability VCID-cmwn-cjff-9qau
18
vulnerability VCID-gnpw-s9hp-wqfs
19
vulnerability VCID-hcuz-gz3w-97ew
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-njph-ua7r-auaq
25
vulnerability VCID-nute-ndg2-z7ev
26
vulnerability VCID-pkve-yjqy-syc2
27
vulnerability VCID-qdwg-f2bx-1bay
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.2
aliases GHSA-r85g-7jpv-8xrx
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qj5k-bcw3-5fgq
37
url VCID-qmfy-dxag-uuex
vulnerability_id VCID-qmfy-dxag-uuex
summary 
Improper Authentication
In SilverStripe, GraphQL does not honour MFA (multi-factor authentication) when using basic authentication.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-26136
reference_id
reference_type
scores
0
value 0.00216
scoring_system epss
scoring_elements 0.44223
published_at 2026-06-05T12:55:00Z
1
value 0.00216
scoring_system epss
scoring_elements 0.44155
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-26136
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2020-26136.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2020-26136.yaml
3
reference_url https://www.silverstripe.org/blog/tag/release
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/blog/tag/release
4
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
5
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-26136
reference_id CVE-2020-26136
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-26136
7
reference_url https://www.silverstripe.org/download/security-releases/cve-2020-26136
reference_id CVE-2020-26136
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2020-26136
8
reference_url https://github.com/advisories/GHSA-mg2g-8pwj-r2j2
reference_id GHSA-mg2g-8pwj-r2j2
reference_type
scores
url https://github.com/advisories/GHSA-mg2g-8pwj-r2j2
fixed_packages
0
url pkg:composer/silverstripe/framework@4.6.0
purl pkg:composer/silverstripe/framework@4.6.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-uy47-3s8a-hbdn
21
vulnerability VCID-xm4q-u96p-57dd
22
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.6.0
aliases CVE-2020-26136, GHSA-mg2g-8pwj-r2j2
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qmfy-dxag-uuex
38
url VCID-r1eg-dwej-5kau
vulnerability_id VCID-r1eg-dwej-5kau
summary 
Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery (CSRF) Protection Bypass in GraphQL.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-12437
reference_id
reference_type
scores
0
value 0.002
scoring_system epss
scoring_elements 0.41982
published_at 2026-06-04T12:55:00Z
1
value 0.002
scoring_system epss
scoring_elements 0.42056
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-12437
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2019-12437.yaml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2019-12437.yaml
3
reference_url https://github.com/silverstripe/silverstripe-graphql
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-graphql
4
reference_url https://github.com/silverstripe/silverstripe-graphql/commit/3c1dd6b839b7c0e2cbc85074bb5840ebded6097c
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-graphql/commit/3c1dd6b839b7c0e2cbc85074bb5840ebded6097c
5
reference_url https://github.com/silverstripe/silverstripe-graphql/commit/db28f3075ae2335905f43ac808e9177497e354ff
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-graphql/commit/db28f3075ae2335905f43ac808e9177497e354ff
6
reference_url https://www.silverstripe.org/blog/tag/release
reference_id
reference_type
scores
url https://www.silverstripe.org/blog/tag/release
7
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-12437
reference_id CVE-2019-12437
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-12437
9
reference_url https://www.silverstripe.org/download/security-releases/cve-2019-12437
reference_id CVE-2019-12437
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2019-12437
fixed_packages
0
url pkg:composer/silverstripe/framework@4.3.4
purl pkg:composer/silverstripe/framework@4.3.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-nzcm-xbxx-wyf9
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.4
aliases CVE-2019-12437, GHSA-fx37-56v6-85q6
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-r1eg-dwej-5kau
39
url VCID-sg62-98yy-2kd7
vulnerability_id VCID-sg62-98yy-2kd7
summary 
Incorrect Authorization
Default SilverStripe GraphQL Server (aka silverstripe/graphql) permission checker is not inherited by query subclass.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-28661
reference_id
reference_type
scores
0
value 0.00169
scoring_system epss
scoring_elements 0.37842
published_at 2026-06-05T12:55:00Z
1
value 0.00169
scoring_system epss
scoring_elements 0.37751
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-28661
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2021-28661.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2021-28661.yaml
2
reference_url https://github.com/silverstripe/silverstripe-graphql
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-graphql
3
reference_url https://github.com/silverstripe/silverstripe-graphql/pull/407/commits/16961459f681f7b32145296189dfdbcc7715e6ed
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-graphql/pull/407/commits/16961459f681f7b32145296189dfdbcc7715e6ed
4
reference_url https://github.com/silverstripe/silverstripe-graphql/releases
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-graphql/releases
5
reference_url https://github.com/silverstripe/silverstripe-graphql/releases/tag/3.5.2
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-graphql/releases/tag/3.5.2
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-28661
reference_id CVE-2021-28661
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-28661
7
reference_url https://www.silverstripe.org/download/security-releases/CVE-2021-28661
reference_id CVE-2021-28661
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2021-28661
8
reference_url https://github.com/advisories/GHSA-r7rh-g777-g5gx
reference_id GHSA-r7rh-g777-g5gx
reference_type
scores
url https://github.com/advisories/GHSA-r7rh-g777-g5gx
fixed_packages
0
url pkg:composer/silverstripe/framework@3.5.2
purl pkg:composer/silverstripe/framework@3.5.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-aygc-4nhm-n7eq
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-cmwn-cjff-9qau
19
vulnerability VCID-fm87-te3v-pkc8
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-h1y5-n4b7-ckg6
22
vulnerability VCID-hcuz-gz3w-97ew
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-nute-ndg2-z7ev
28
vulnerability VCID-pkve-yjqy-syc2
29
vulnerability VCID-qdwg-f2bx-1bay
30
vulnerability VCID-qmfy-dxag-uuex
31
vulnerability VCID-r1eg-dwej-5kau
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
39
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.5.2
aliases CVE-2021-28661, GHSA-r7rh-g777-g5gx
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-sg62-98yy-2kd7
40
url VCID-t81f-5b8z-hyht
vulnerability_id VCID-t81f-5b8z-hyht
summary 
XSS In page name
SilverStripe is vulnerable to XSS via the page name. For instance, page name `"><svg/onload=alert(/xss/)>` will trigger an XSS alert.
references
0
reference_url https://github.com/silverstripe/silverstripe-framework/commit/c6c6c13fc265aeedf5de7226b3cde39d185ba49d
reference_id
reference_type
scores
url https://github.com/silverstripe/silverstripe-framework/commit/c6c6c13fc265aeedf5de7226b3cde39d185ba49d
1
reference_url https://www.silverstripe.org/download/security-releases/ss-2017-001/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2017-001/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.4.4-rc1
purl pkg:composer/silverstripe/framework@3.4.4-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-3j6f-5c14-uubc
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4qjj-wqg5-dbay
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7hxq-cp29-r7dh
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-bwrh-updj-zkfs
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-k46z-g6jp-57ek
20
vulnerability VCID-ky21-z2d2-sye6
21
vulnerability VCID-mkex-ht2r-cucz
22
vulnerability VCID-n4fk-735u-2baw
23
vulnerability VCID-njph-ua7r-auaq
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qmfy-dxag-uuex
28
vulnerability VCID-r1eg-dwej-5kau
29
vulnerability VCID-sg62-98yy-2kd7
30
vulnerability VCID-tv7h-289s-xub4
31
vulnerability VCID-umhc-fdfh-1fdx
32
vulnerability VCID-uy47-3s8a-hbdn
33
vulnerability VCID-wgdv-etcq-3qhw
34
vulnerability VCID-xg74-3h1h-kqaf
35
vulnerability VCID-y8et-m846-2fc6
36
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.4-rc1
1
url pkg:composer/silverstripe/framework@3.5.2-rc1
purl pkg:composer/silverstripe/framework@3.5.2-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-37d1-tt74-yyfm
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-aygc-4nhm-n7eq
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-cmwn-cjff-9qau
19
vulnerability VCID-fm87-te3v-pkc8
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-h1y5-n4b7-ckg6
22
vulnerability VCID-hcuz-gz3w-97ew
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qmfy-dxag-uuex
32
vulnerability VCID-r1eg-dwej-5kau
33
vulnerability VCID-sg62-98yy-2kd7
34
vulnerability VCID-tv7h-289s-xub4
35
vulnerability VCID-umhc-fdfh-1fdx
36
vulnerability VCID-uy47-3s8a-hbdn
37
vulnerability VCID-wgdv-etcq-3qhw
38
vulnerability VCID-xg74-3h1h-kqaf
39
vulnerability VCID-y8et-m846-2fc6
40
vulnerability VCID-zdge-zsmz-8ud9
41
vulnerability VCID-znbg-16r4-6ybg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.5.2-rc1
aliases SS-2017-001
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-t81f-5b8z-hyht
41
url VCID-tv7h-289s-xub4
vulnerability_id VCID-tv7h-289s-xub4
summary 
Improper Restriction of XML External Entity Reference
SilverStripe has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-25817
reference_id
reference_type
scores
0
value 0.00348
scoring_system epss
scoring_elements 0.5767
published_at 2026-06-05T12:55:00Z
1
value 0.00348
scoring_system epss
scoring_elements 0.57618
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-25817
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
3
reference_url https://www.silverstripe.org/blog/tag/release
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/blog/tag/release
4
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
5
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
6
reference_url https://www.silverstripe.org/download/security-releases/cve-2021-25817
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2021-25817
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-25817
reference_id CVE-2020-25817
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-25817
8
reference_url https://github.com/advisories/GHSA-3vjc-5x79-m9r8
reference_id GHSA-3vjc-5x79-m9r8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3vjc-5x79-m9r8
fixed_packages
0
url pkg:composer/silverstripe/framework@4.6.0
purl pkg:composer/silverstripe/framework@4.6.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-uy47-3s8a-hbdn
21
vulnerability VCID-xm4q-u96p-57dd
22
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.6.0
1
url pkg:composer/silverstripe/framework@4.7.4
purl pkg:composer/silverstripe/framework@4.7.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-uy47-3s8a-hbdn
21
vulnerability VCID-xm4q-u96p-57dd
22
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.7.4
aliases CVE-2020-25817, GHSA-3vjc-5x79-m9r8
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-tv7h-289s-xub4
42
url VCID-umhc-fdfh-1fdx
vulnerability_id VCID-umhc-fdfh-1fdx
summary 
Cross-site Scripting
In SilverStripe, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-9311
reference_id
reference_type
scores
0
value 0.00343
scoring_system epss
scoring_elements 0.57206
published_at 2026-06-05T12:55:00Z
1
value 0.00343
scoring_system epss
scoring_elements 0.57155
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-9311
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2020-9311.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2020-9311.yaml
2
reference_url https://github.com/silverstripe/silverstripe-cms
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-cms
3
reference_url https://www.silverstripe.org/download/security-releases/cve-2020-9311
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2020-9311
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-9311
reference_id CVE-2020-9311
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-9311
5
reference_url https://www.silverstripe.org/download/security-releases/CVE-2020-9311
reference_id CVE-2020-9311
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2020-9311
6
reference_url https://github.com/advisories/GHSA-2pw2-qpcp-m47x
reference_id GHSA-2pw2-qpcp-m47x
reference_type
scores
url https://github.com/advisories/GHSA-2pw2-qpcp-m47x
fixed_packages
0
url pkg:composer/silverstripe/framework@3.7.5
purl pkg:composer/silverstripe/framework@3.7.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-86vg-4j71-hkgr
5
vulnerability VCID-8u5c-6vx3-mfcr
6
vulnerability VCID-9y5u-qyzd-3ud9
7
vulnerability VCID-a7cf-kpzy-xudd
8
vulnerability VCID-gnpw-s9hp-wqfs
9
vulnerability VCID-hcuz-gz3w-97ew
10
vulnerability VCID-k46z-g6jp-57ek
11
vulnerability VCID-ky21-z2d2-sye6
12
vulnerability VCID-n4fk-735u-2baw
13
vulnerability VCID-qmfy-dxag-uuex
14
vulnerability VCID-tv7h-289s-xub4
15
vulnerability VCID-uy47-3s8a-hbdn
16
vulnerability VCID-wgdv-etcq-3qhw
17
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.7.5
aliases CVE-2020-9311, GHSA-2pw2-qpcp-m47x
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-umhc-fdfh-1fdx
43
url VCID-uy47-3s8a-hbdn
vulnerability_id VCID-uy47-3s8a-hbdn
summary 
Silverstipe CMS Stored XSS in custom meta tags
A malicious content author could create a custom meta tag and execute an arbitrary JavaScript payload. This would require convincing a legitimate user to access a page and enter a custom keyboard shortcut.
This requires CMS access to exploit.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-37421
reference_id
reference_type
scores
0
value 0.00322
scoring_system epss
scoring_elements 0.55551
published_at 2026-06-05T12:55:00Z
1
value 0.00322
scoring_system epss
scoring_elements 0.55495
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-37421
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T20:34:09Z/
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/cms/CVE-2022-37421.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/cms/CVE-2022-37421.yaml
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-37421
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-37421
4
reference_url https://www.silverstripe.org/blog/tag/release
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T20:34:09Z/
url https://www.silverstripe.org/blog/tag/release
5
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
6
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T20:34:09Z/
url https://www.silverstripe.org/download/security-releases/
7
reference_url https://www.silverstripe.org/download/security-releases/cve-2022-37421
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2022-37421
8
reference_url https://www.silverstripe.org/download/security-releases/CVE-2022-37421
reference_id CVE-2022-37421
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T20:34:09Z/
url https://www.silverstripe.org/download/security-releases/CVE-2022-37421
9
reference_url https://github.com/advisories/GHSA-pp74-g2q5-j4jf
reference_id GHSA-pp74-g2q5-j4jf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-pp74-g2q5-j4jf
fixed_packages
0
url pkg:composer/silverstripe/framework@4.11.3
purl pkg:composer/silverstripe/framework@4.11.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7gak-15m5-j3f5
5
vulnerability VCID-7w7t-3783-1kbs
6
vulnerability VCID-86vg-4j71-hkgr
7
vulnerability VCID-8u5c-6vx3-mfcr
8
vulnerability VCID-9t4k-8hsz-bfdw
9
vulnerability VCID-9y5u-qyzd-3ud9
10
vulnerability VCID-a7cf-kpzy-xudd
11
vulnerability VCID-ca4q-xd4v-vqfe
12
vulnerability VCID-gnpw-s9hp-wqfs
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-xm4q-u96p-57dd
16
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.11.3
aliases CVE-2022-37421, GHSA-pp74-g2q5-j4jf, GMS-2022-6855
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uy47-3s8a-hbdn
44
url VCID-vatg-guxu-2ud7
vulnerability_id VCID-vatg-guxu-2ud7
summary 
silverstripe/framework missing ACL on reports
The SS_Report, and the reports CMS section only checks `canView()` when listing the reports that can be viewed by the current user.

It does not (and should) perform `canView` checks when the report is actually viewed, so if you know the URL to a report and can otherwise access the Reports section of the CMS, you can view any report.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-012-1.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-012-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-012
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-012
3
reference_url https://github.com/advisories/GHSA-52cx-hpc5-cxwc
reference_id GHSA-52cx-hpc5-cxwc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-52cx-hpc5-cxwc
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
aliases GHSA-52cx-hpc5-cxwc
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vatg-guxu-2ud7
45
url VCID-wgdv-etcq-3qhw
vulnerability_id VCID-wgdv-etcq-3qhw
summary 
Improper Input Validation
In SilverStripe, a FormField with square brackets in the field name skips validation.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-26138
reference_id
reference_type
scores
0
value 0.00292
scoring_system epss
scoring_elements 0.52854
published_at 2026-06-04T12:55:00Z
1
value 0.00292
scoring_system epss
scoring_elements 0.52915
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-26138
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2020-26138.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2020-26138.yaml
3
reference_url https://www.silverstripe.org/blog/tag/release
reference_id
reference_type
scores
url https://www.silverstripe.org/blog/tag/release
4
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-26138
reference_id CVE-2020-26138
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-26138
6
reference_url https://www.silverstripe.org/download/security-releases/cve-2020-26138
reference_id CVE-2020-26138
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2020-26138
7
reference_url https://www.silverstripe.org/download/security-releases/cve-2020-26138/
reference_id CVE-2020-26138
reference_type
scores
url https://www.silverstripe.org/download/security-releases/cve-2020-26138/
8
reference_url https://github.com/advisories/GHSA-7mv4-4xpg-xq44
reference_id GHSA-7mv4-4xpg-xq44
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7mv4-4xpg-xq44
fixed_packages
0
url pkg:composer/silverstripe/framework@4.6.0
purl pkg:composer/silverstripe/framework@4.6.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-uy47-3s8a-hbdn
21
vulnerability VCID-xm4q-u96p-57dd
22
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.6.0
1
url pkg:composer/silverstripe/framework@4.7.4
purl pkg:composer/silverstripe/framework@4.7.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-uy47-3s8a-hbdn
21
vulnerability VCID-xm4q-u96p-57dd
22
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.7.4
aliases CVE-2020-26138, GHSA-7mv4-4xpg-xq44
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wgdv-etcq-3qhw
46
url VCID-xg74-3h1h-kqaf
vulnerability_id VCID-xg74-3h1h-kqaf
summary 
Uncontrolled Resource Consumption
SilverStripe allows a Denial of Service on flush and development URL tools.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-12246
reference_id
reference_type
scores
0
value 0.00156
scoring_system epss
scoring_elements 0.36088
published_at 2026-06-05T12:55:00Z
1
value 0.00156
scoring_system epss
scoring_elements 0.35994
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-12246
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://forum.silverstripe.org/c/releases
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12246.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12246.yaml
3
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
4
reference_url https://github.com/silverstripe/silverstripe-framework/commit/ca56e8d78e468874b9267c94d8ec75240b6da0ab
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/ca56e8d78e468874b9267c94d8ec75240b6da0ab
5
reference_url https://www.silverstripe.org/blog/tag/release
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/blog/tag/release
6
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-12246
reference_id CVE-2019-12246
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-12246
8
reference_url https://www.silverstripe.org/download/security-releases/cve-2019-12246
reference_id CVE-2019-12246
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2019-12246
fixed_packages
0
url pkg:composer/silverstripe/framework@4.3.4
purl pkg:composer/silverstripe/framework@4.3.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-nzcm-xbxx-wyf9
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.4
1
url pkg:composer/silverstripe/framework@4.4.0
purl pkg:composer/silverstripe/framework@4.4.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-5dt7-nc8t-nqgh
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7gak-15m5-j3f5
8
vulnerability VCID-7w7t-3783-1kbs
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9t4k-8hsz-bfdw
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-b6nm-cphj-wfgw
15
vulnerability VCID-ca4q-xd4v-vqfe
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-fmfu-81xu-pfdy
18
vulnerability VCID-gnpw-s9hp-wqfs
19
vulnerability VCID-hcuz-gz3w-97ew
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nzcm-xbxx-wyf9
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qmfy-dxag-uuex
27
vulnerability VCID-ru3j-21j8-ayhm
28
vulnerability VCID-tv7h-289s-xub4
29
vulnerability VCID-uy47-3s8a-hbdn
30
vulnerability VCID-wgdv-etcq-3qhw
31
vulnerability VCID-xm4q-u96p-57dd
32
vulnerability VCID-y8et-m846-2fc6
33
vulnerability VCID-ytbc-8mhd-b3fc
34
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.4.0
aliases CVE-2019-12246, GHSA-5fr8-xhqq-4p3q
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xg74-3h1h-kqaf
47
url VCID-y6gd-vy49-17b4
vulnerability_id VCID-y6gd-vy49-17b4
summary 
silverstripe/framework password encryption salt not updated
When a user changes their password, the internal salt used for hashing their password is not updated.

Although this is not considered a security vulnerability, this behaviour has been improved to ensure the salt is reset on change of password.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-008-1.yaml
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-008-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/08384bb4d6b98c44388ffb4727c317ed14fe3c81
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/08384bb4d6b98c44388ffb4727c317ed14fe3c81
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/298f61521c55b07e5c898a92264dbe111735a87a
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/298f61521c55b07e5c898a92264dbe111735a87a
4
reference_url https://github.com/silverstripe/silverstripe-framework/commit/dc47f7ec9adf67a3f31887467de5b110e8e5b285
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/dc47f7ec9adf67a3f31887467de5b110e8e5b285
5
reference_url https://github.com/silverstripe/silverstripe-framework/commit/f85dea2e6d5b303abd43b5e5efc07c66c8d2acf4
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/f85dea2e6d5b303abd43b5e5efc07c66c8d2acf4
6
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-008
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-008
7
reference_url https://github.com/advisories/GHSA-f3wp-xpv2-6vmg
reference_id GHSA-f3wp-xpv2-6vmg
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-f3wp-xpv2-6vmg
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
aliases GHSA-f3wp-xpv2-6vmg
risk_score 1.4
exploitability 0.5
weighted_severity 2.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-y6gd-vy49-17b4
48
url VCID-y8et-m846-2fc6
vulnerability_id VCID-y8et-m846-2fc6
summary 
Information Exposure
SilverStripe has incorrect access control for protected files uploaded via `Upload::loadIntoFile()`. An attacker may be able to guess a filename in `silverstripe/assets` via the `AssetControlExtension`.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-12245
reference_id
reference_type
scores
0
value 0.00255
scoring_system epss
scoring_elements 0.49005
published_at 2026-06-04T12:55:00Z
1
value 0.00255
scoring_system epss
scoring_elements 0.49066
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-12245
1
reference_url https://forum.silverstripe.org/c/releases
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://forum.silverstripe.org/c/releases
2
reference_url https://www.silverstripe.org/download/security-releases
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases
3
reference_url https://www.silverstripe.org/download/security-releases/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/
4
reference_url https://www.silverstripe.org/download/security-releases/cve-2019-12245
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2019-12245
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-12245
reference_id CVE-2019-12245
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-12245
6
reference_url https://www.silverstripe.org/download/security-releases/cve-2019-12245/
reference_id CVE-2019-12245
reference_type
scores
url https://www.silverstripe.org/download/security-releases/cve-2019-12245/
7
reference_url https://www.silverstripe.org/download/security-releases/CVE-2019-12245
reference_id CVE-2019-12245
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/CVE-2019-12245
8
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2019-12245.yaml
reference_id CVE-2019-12245.YAML
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2019-12245.yaml
9
reference_url https://github.com/advisories/GHSA-jvx5-rm6q-gx7p
reference_id GHSA-jvx5-rm6q-gx7p
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-jvx5-rm6q-gx7p
fixed_packages
0
url pkg:composer/silverstripe/framework@3.6.8
purl pkg:composer/silverstripe/framework@3.6.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-pkve-yjqy-syc2
19
vulnerability VCID-qmfy-dxag-uuex
20
vulnerability VCID-r1eg-dwej-5kau
21
vulnerability VCID-tv7h-289s-xub4
22
vulnerability VCID-u9e7-1zhg-mygt
23
vulnerability VCID-umhc-fdfh-1fdx
24
vulnerability VCID-uy47-3s8a-hbdn
25
vulnerability VCID-wgdv-etcq-3qhw
26
vulnerability VCID-xg74-3h1h-kqaf
27
vulnerability VCID-y8et-m846-2fc6
28
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.6.8
1
url pkg:composer/silverstripe/framework@3.7.4
purl pkg:composer/silverstripe/framework@3.7.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-pkve-yjqy-syc2
19
vulnerability VCID-qmfy-dxag-uuex
20
vulnerability VCID-r1eg-dwej-5kau
21
vulnerability VCID-tv7h-289s-xub4
22
vulnerability VCID-umhc-fdfh-1fdx
23
vulnerability VCID-uy47-3s8a-hbdn
24
vulnerability VCID-wgdv-etcq-3qhw
25
vulnerability VCID-xg74-3h1h-kqaf
26
vulnerability VCID-y8et-m846-2fc6
27
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.7.4
2
url pkg:composer/silverstripe/framework@4.3.4
purl pkg:composer/silverstripe/framework@4.3.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-79qx-v5uu-jyf2
6
vulnerability VCID-7gak-15m5-j3f5
7
vulnerability VCID-7w7t-3783-1kbs
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9t4k-8hsz-bfdw
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-ca4q-xd4v-vqfe
14
vulnerability VCID-fmfu-81xu-pfdy
15
vulnerability VCID-gnpw-s9hp-wqfs
16
vulnerability VCID-hcuz-gz3w-97ew
17
vulnerability VCID-k46z-g6jp-57ek
18
vulnerability VCID-ky21-z2d2-sye6
19
vulnerability VCID-n4fk-735u-2baw
20
vulnerability VCID-nzcm-xbxx-wyf9
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.4
3
url pkg:composer/silverstripe/framework@4.3.6
purl pkg:composer/silverstripe/framework@4.3.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.3.6
4
url pkg:composer/silverstripe/framework@4.4.4
purl pkg:composer/silverstripe/framework@4.4.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-24a5-ruc4-bycq
3
vulnerability VCID-2hk2-hzyh-wbhf
4
vulnerability VCID-5cfa-whq6-9ucp
5
vulnerability VCID-5dt7-nc8t-nqgh
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7gak-15m5-j3f5
8
vulnerability VCID-7w7t-3783-1kbs
9
vulnerability VCID-86vg-4j71-hkgr
10
vulnerability VCID-8u5c-6vx3-mfcr
11
vulnerability VCID-9t4k-8hsz-bfdw
12
vulnerability VCID-9y5u-qyzd-3ud9
13
vulnerability VCID-a7cf-kpzy-xudd
14
vulnerability VCID-ca4q-xd4v-vqfe
15
vulnerability VCID-fmfu-81xu-pfdy
16
vulnerability VCID-gnpw-s9hp-wqfs
17
vulnerability VCID-hcuz-gz3w-97ew
18
vulnerability VCID-k46z-g6jp-57ek
19
vulnerability VCID-ky21-z2d2-sye6
20
vulnerability VCID-n4fk-735u-2baw
21
vulnerability VCID-pkve-yjqy-syc2
22
vulnerability VCID-qmfy-dxag-uuex
23
vulnerability VCID-ru3j-21j8-ayhm
24
vulnerability VCID-tv7h-289s-xub4
25
vulnerability VCID-uy47-3s8a-hbdn
26
vulnerability VCID-wgdv-etcq-3qhw
27
vulnerability VCID-xm4q-u96p-57dd
28
vulnerability VCID-ytbc-8mhd-b3fc
29
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.4.4
aliases CVE-2019-12245, GHSA-jvx5-rm6q-gx7p
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-y8et-m846-2fc6
49
url VCID-z28b-1yrx-1bbn
vulnerability_id VCID-z28b-1yrx-1bbn
summary 
Password encryption salt expiry
When a user changes their password, the internal salt used for hashing their password is not updated.
references
0
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-008/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2016-008/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.5
purl pkg:composer/silverstripe/framework@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.5
1
url pkg:composer/silverstripe/framework@3.3.3
purl pkg:composer/silverstripe/framework@3.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-5cfa-whq6-9ucp
6
vulnerability VCID-79qx-v5uu-jyf2
7
vulnerability VCID-7hxq-cp29-r7dh
8
vulnerability VCID-86vg-4j71-hkgr
9
vulnerability VCID-8u5c-6vx3-mfcr
10
vulnerability VCID-9hf4-djcv-67d7
11
vulnerability VCID-9y5u-qyzd-3ud9
12
vulnerability VCID-a7cf-kpzy-xudd
13
vulnerability VCID-b6nm-cphj-wfgw
14
vulnerability VCID-b95v-49p7-fkas
15
vulnerability VCID-c6bz-jwhm-vkgp
16
vulnerability VCID-cmwn-cjff-9qau
17
vulnerability VCID-gnpw-s9hp-wqfs
18
vulnerability VCID-hcuz-gz3w-97ew
19
vulnerability VCID-hnme-cqff-c7dp
20
vulnerability VCID-k46z-g6jp-57ek
21
vulnerability VCID-ky21-z2d2-sye6
22
vulnerability VCID-mkex-ht2r-cucz
23
vulnerability VCID-n4fk-735u-2baw
24
vulnerability VCID-nute-ndg2-z7ev
25
vulnerability VCID-pkve-yjqy-syc2
26
vulnerability VCID-qdwg-f2bx-1bay
27
vulnerability VCID-qj5k-bcw3-5fgq
28
vulnerability VCID-qmfy-dxag-uuex
29
vulnerability VCID-r1eg-dwej-5kau
30
vulnerability VCID-sg62-98yy-2kd7
31
vulnerability VCID-t81f-5b8z-hyht
32
vulnerability VCID-tv7h-289s-xub4
33
vulnerability VCID-umhc-fdfh-1fdx
34
vulnerability VCID-uy47-3s8a-hbdn
35
vulnerability VCID-wgdv-etcq-3qhw
36
vulnerability VCID-xg74-3h1h-kqaf
37
vulnerability VCID-y8et-m846-2fc6
38
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.3
2
url pkg:composer/silverstripe/framework@3.4.1
purl pkg:composer/silverstripe/framework@3.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3j6f-5c14-uubc
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4qjj-wqg5-dbay
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-86vg-4j71-hkgr
11
vulnerability VCID-8u5c-6vx3-mfcr
12
vulnerability VCID-9hf4-djcv-67d7
13
vulnerability VCID-9y5u-qyzd-3ud9
14
vulnerability VCID-a7cf-kpzy-xudd
15
vulnerability VCID-b6nm-cphj-wfgw
16
vulnerability VCID-b95v-49p7-fkas
17
vulnerability VCID-bwrh-updj-zkfs
18
vulnerability VCID-c6bz-jwhm-vkgp
19
vulnerability VCID-cmwn-cjff-9qau
20
vulnerability VCID-gnpw-s9hp-wqfs
21
vulnerability VCID-hcuz-gz3w-97ew
22
vulnerability VCID-hnme-cqff-c7dp
23
vulnerability VCID-k46z-g6jp-57ek
24
vulnerability VCID-ky21-z2d2-sye6
25
vulnerability VCID-mkex-ht2r-cucz
26
vulnerability VCID-n4fk-735u-2baw
27
vulnerability VCID-njph-ua7r-auaq
28
vulnerability VCID-nute-ndg2-z7ev
29
vulnerability VCID-pkve-yjqy-syc2
30
vulnerability VCID-qdwg-f2bx-1bay
31
vulnerability VCID-qj5k-bcw3-5fgq
32
vulnerability VCID-qmfy-dxag-uuex
33
vulnerability VCID-r1eg-dwej-5kau
34
vulnerability VCID-sg62-98yy-2kd7
35
vulnerability VCID-t81f-5b8z-hyht
36
vulnerability VCID-tv7h-289s-xub4
37
vulnerability VCID-umhc-fdfh-1fdx
38
vulnerability VCID-uy47-3s8a-hbdn
39
vulnerability VCID-wgdv-etcq-3qhw
40
vulnerability VCID-xg74-3h1h-kqaf
41
vulnerability VCID-y8et-m846-2fc6
42
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.4.1
3
url pkg:composer/silverstripe/framework@4.0.0-alpha1
purl pkg:composer/silverstripe/framework@4.0.0-alpha1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1p79-328x-sueq
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-7hxq-cp29-r7dh
5
vulnerability VCID-86vg-4j71-hkgr
6
vulnerability VCID-8u5c-6vx3-mfcr
7
vulnerability VCID-9y5u-qyzd-3ud9
8
vulnerability VCID-a7cf-kpzy-xudd
9
vulnerability VCID-b6nm-cphj-wfgw
10
vulnerability VCID-cmwn-cjff-9qau
11
vulnerability VCID-gnpw-s9hp-wqfs
12
vulnerability VCID-hcuz-gz3w-97ew
13
vulnerability VCID-k46z-g6jp-57ek
14
vulnerability VCID-ky21-z2d2-sye6
15
vulnerability VCID-mkex-ht2r-cucz
16
vulnerability VCID-n4fk-735u-2baw
17
vulnerability VCID-nute-ndg2-z7ev
18
vulnerability VCID-qmfy-dxag-uuex
19
vulnerability VCID-r1eg-dwej-5kau
20
vulnerability VCID-tv7h-289s-xub4
21
vulnerability VCID-uy47-3s8a-hbdn
22
vulnerability VCID-wgdv-etcq-3qhw
23
vulnerability VCID-xg74-3h1h-kqaf
24
vulnerability VCID-y8et-m846-2fc6
25
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.0-alpha1
aliases SS-2016-008
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-z28b-1yrx-1bbn
50
url VCID-zdge-zsmz-8ud9
vulnerability_id VCID-zdge-zsmz-8ud9
summary 
Missing Authorization
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-22728
reference_id
reference_type
scores
0
value 0.00054
scoring_system epss
scoring_elements 0.1724
published_at 2026-06-04T12:55:00Z
1
value 0.00054
scoring_system epss
scoring_elements 0.17318
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-22728
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-22728.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-22728.yaml
2
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/fd5d8217e83768d7bf841e94b2d4d82642d5bc58
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T16:10:52Z/
url https://github.com/silverstripe/silverstripe-framework/commit/fd5d8217e83768d7bf841e94b2d4d82642d5bc58
4
reference_url https://www.silverstripe.org/download/security-releases/cve-2023-22728
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/cve-2023-22728
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-22728
reference_id CVE-2023-22728
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-22728
6
reference_url https://github.com/advisories/GHSA-jh3w-6jp2-vqqm
reference_id GHSA-jh3w-6jp2-vqqm
reference_type
scores
url https://github.com/advisories/GHSA-jh3w-6jp2-vqqm
7
reference_url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-jh3w-6jp2-vqqm
reference_id GHSA-jh3w-6jp2-vqqm
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T16:10:52Z/
url https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-jh3w-6jp2-vqqm
fixed_packages
0
url pkg:composer/silverstripe/framework@4.12.5
purl pkg:composer/silverstripe/framework@4.12.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-2hk2-hzyh-wbhf
2
vulnerability VCID-5cfa-whq6-9ucp
3
vulnerability VCID-79qx-v5uu-jyf2
4
vulnerability VCID-86vg-4j71-hkgr
5
vulnerability VCID-8u5c-6vx3-mfcr
6
vulnerability VCID-9y5u-qyzd-3ud9
7
vulnerability VCID-gnpw-s9hp-wqfs
8
vulnerability VCID-k46z-g6jp-57ek
9
vulnerability VCID-ky21-z2d2-sye6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.12.5
aliases CVE-2023-22728, GHSA-jh3w-6jp2-vqqm
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zdge-zsmz-8ud9
Fixing_vulnerabilities
0
url VCID-1uhv-fetz-j7fd
vulnerability_id VCID-1uhv-fetz-j7fd
summary 
XSS in CMSController BackURL
A XSS risk exists in the returnURL parameter passed to CMSSecurity/success. An unvalidated url could cause the user to redirect to an unverified third party url outside of the site.
references
0
reference_url https://github.com/silverstripe/silverstripe-framework/commit/1ccd3926e3dcecaa5c1b4f26a390d9eacc24a893
reference_id
reference_type
scores
url https://github.com/silverstripe/silverstripe-framework/commit/1ccd3926e3dcecaa5c1b4f26a390d9eacc24a893
1
reference_url http://www.silverstripe.org/download/security-releases/ss-2016-001
reference_id
reference_type
scores
url http://www.silverstripe.org/download/security-releases/ss-2016-001
fixed_packages
0
url pkg:composer/silverstripe/framework@3.1.19-rc1
purl pkg:composer/silverstripe/framework@3.1.19-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9ugf-duna-xfgy
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-excr-b2pz-jydm
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-v9ch-up34-nuab
47
vulnerability VCID-vatg-guxu-2ud7
48
vulnerability VCID-wgdv-etcq-3qhw
49
vulnerability VCID-xg74-3h1h-kqaf
50
vulnerability VCID-xsgv-a7bd-fqh8
51
vulnerability VCID-y6gd-vy49-17b4
52
vulnerability VCID-y8et-m846-2fc6
53
vulnerability VCID-z28b-1yrx-1bbn
54
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19-rc1
1
url pkg:composer/silverstripe/framework@3.1.19
purl pkg:composer/silverstripe/framework@3.1.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-xsgv-a7bd-fqh8
48
vulnerability VCID-y6gd-vy49-17b4
49
vulnerability VCID-y8et-m846-2fc6
50
vulnerability VCID-z28b-1yrx-1bbn
51
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19
2
url pkg:composer/silverstripe/framework@3.2.4-rc1
purl pkg:composer/silverstripe/framework@3.2.4-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9ugf-duna-xfgy
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-excr-b2pz-jydm
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-v9ch-up34-nuab
47
vulnerability VCID-vatg-guxu-2ud7
48
vulnerability VCID-wgdv-etcq-3qhw
49
vulnerability VCID-xg74-3h1h-kqaf
50
vulnerability VCID-y6gd-vy49-17b4
51
vulnerability VCID-y8et-m846-2fc6
52
vulnerability VCID-z28b-1yrx-1bbn
53
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4-rc1
3
url pkg:composer/silverstripe/framework@3.2.4
purl pkg:composer/silverstripe/framework@3.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-y6gd-vy49-17b4
48
vulnerability VCID-y8et-m846-2fc6
49
vulnerability VCID-z28b-1yrx-1bbn
50
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4
4
url pkg:composer/silverstripe/framework@3.3.2-rc1
purl pkg:composer/silverstripe/framework@3.3.2-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9ugf-duna-xfgy
16
vulnerability VCID-9y5u-qyzd-3ud9
17
vulnerability VCID-a7cf-kpzy-xudd
18
vulnerability VCID-at1s-qxsg-5yfs
19
vulnerability VCID-b6nm-cphj-wfgw
20
vulnerability VCID-b95v-49p7-fkas
21
vulnerability VCID-c437-w2zy-y7c9
22
vulnerability VCID-c6bz-jwhm-vkgp
23
vulnerability VCID-cmwn-cjff-9qau
24
vulnerability VCID-czh2-w6fk-xqd6
25
vulnerability VCID-ewg1-jqza-eyez
26
vulnerability VCID-excr-b2pz-jydm
27
vulnerability VCID-gkkp-9fm7-jfaz
28
vulnerability VCID-gnpw-s9hp-wqfs
29
vulnerability VCID-hcuz-gz3w-97ew
30
vulnerability VCID-hnme-cqff-c7dp
31
vulnerability VCID-k46z-g6jp-57ek
32
vulnerability VCID-ky21-z2d2-sye6
33
vulnerability VCID-mkex-ht2r-cucz
34
vulnerability VCID-n1mj-u4yk-jqhn
35
vulnerability VCID-n4fk-735u-2baw
36
vulnerability VCID-nute-ndg2-z7ev
37
vulnerability VCID-pkve-yjqy-syc2
38
vulnerability VCID-qdwg-f2bx-1bay
39
vulnerability VCID-qj5k-bcw3-5fgq
40
vulnerability VCID-qmfy-dxag-uuex
41
vulnerability VCID-r1eg-dwej-5kau
42
vulnerability VCID-sg62-98yy-2kd7
43
vulnerability VCID-t81f-5b8z-hyht
44
vulnerability VCID-tv7h-289s-xub4
45
vulnerability VCID-umhc-fdfh-1fdx
46
vulnerability VCID-uy47-3s8a-hbdn
47
vulnerability VCID-v9ch-up34-nuab
48
vulnerability VCID-vatg-guxu-2ud7
49
vulnerability VCID-wgdv-etcq-3qhw
50
vulnerability VCID-xg74-3h1h-kqaf
51
vulnerability VCID-y6gd-vy49-17b4
52
vulnerability VCID-y8et-m846-2fc6
53
vulnerability VCID-z28b-1yrx-1bbn
54
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2-rc1
5
url pkg:composer/silverstripe/framework@3.3.2
purl pkg:composer/silverstripe/framework@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-f4hv-79km-3ygt
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-vatg-guxu-2ud7
47
vulnerability VCID-wgdv-etcq-3qhw
48
vulnerability VCID-xg74-3h1h-kqaf
49
vulnerability VCID-y6gd-vy49-17b4
50
vulnerability VCID-y8et-m846-2fc6
51
vulnerability VCID-z28b-1yrx-1bbn
52
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2
aliases SS-2016-001
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1uhv-fetz-j7fd
1
url VCID-9ugf-duna-xfgy
vulnerability_id VCID-9ugf-duna-xfgy
summary 
Silverstripe XSS in CMS Edit Page
Due to a lack of parameter sanitisation a carefully crafted URL could be used to inject arbitrary HTML into the CMS Edit page.

An attacker could create a URL and share it with a site administrator to perform an attack.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-004-1.yaml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-004-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/a24c8260b1d048dc6a0836eb1be9a1ca2056e770
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/a24c8260b1d048dc6a0836eb1be9a1ca2056e770
3
reference_url https://github.com/silverstripe/silverstripe-framework/commits/3.3.2
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commits/3.3.2
4
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-004
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-004
5
reference_url https://github.com/advisories/GHSA-m8v7-x398-pxrf
reference_id GHSA-m8v7-x398-pxrf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-m8v7-x398-pxrf
fixed_packages
0
url pkg:composer/silverstripe/framework@3.1.19
purl pkg:composer/silverstripe/framework@3.1.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-xsgv-a7bd-fqh8
48
vulnerability VCID-y6gd-vy49-17b4
49
vulnerability VCID-y8et-m846-2fc6
50
vulnerability VCID-z28b-1yrx-1bbn
51
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19
1
url pkg:composer/silverstripe/framework@3.2.4
purl pkg:composer/silverstripe/framework@3.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-y6gd-vy49-17b4
48
vulnerability VCID-y8et-m846-2fc6
49
vulnerability VCID-z28b-1yrx-1bbn
50
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4
2
url pkg:composer/silverstripe/framework@3.3.2
purl pkg:composer/silverstripe/framework@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-f4hv-79km-3ygt
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-vatg-guxu-2ud7
47
vulnerability VCID-wgdv-etcq-3qhw
48
vulnerability VCID-xg74-3h1h-kqaf
49
vulnerability VCID-y6gd-vy49-17b4
50
vulnerability VCID-y8et-m846-2fc6
51
vulnerability VCID-z28b-1yrx-1bbn
52
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2
aliases GHSA-m8v7-x398-pxrf
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9ugf-duna-xfgy
2
url VCID-evh4-xq48-4fa6
vulnerability_id VCID-evh4-xq48-4fa6
summary 
Brute force bypass on default admin
Default Administrator accounts were not subject to the same brute force protection afforded to other Member accounts. Failed login counts were not logged for default admins resulting in unlimited attempts on the default admin username and password.
references
0
reference_url https://github.com/silverstripe/silverstripe-framework/commit/f32c893546340c8c279fd1ab6d4269e9d6539bc2
reference_id
reference_type
scores
url https://github.com/silverstripe/silverstripe-framework/commit/f32c893546340c8c279fd1ab6d4269e9d6539bc2
1
reference_url http://www.silverstripe.org/download/security-releases/ss-2016-005
reference_id
reference_type
scores
url http://www.silverstripe.org/download/security-releases/ss-2016-005
fixed_packages
0
url pkg:composer/silverstripe/framework@3.1.19-rc1
purl pkg:composer/silverstripe/framework@3.1.19-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9ugf-duna-xfgy
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-excr-b2pz-jydm
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-v9ch-up34-nuab
47
vulnerability VCID-vatg-guxu-2ud7
48
vulnerability VCID-wgdv-etcq-3qhw
49
vulnerability VCID-xg74-3h1h-kqaf
50
vulnerability VCID-xsgv-a7bd-fqh8
51
vulnerability VCID-y6gd-vy49-17b4
52
vulnerability VCID-y8et-m846-2fc6
53
vulnerability VCID-z28b-1yrx-1bbn
54
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19-rc1
1
url pkg:composer/silverstripe/framework@3.1.19
purl pkg:composer/silverstripe/framework@3.1.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-xsgv-a7bd-fqh8
48
vulnerability VCID-y6gd-vy49-17b4
49
vulnerability VCID-y8et-m846-2fc6
50
vulnerability VCID-z28b-1yrx-1bbn
51
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19
2
url pkg:composer/silverstripe/framework@3.2.4-rc1
purl pkg:composer/silverstripe/framework@3.2.4-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9ugf-duna-xfgy
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-excr-b2pz-jydm
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-v9ch-up34-nuab
47
vulnerability VCID-vatg-guxu-2ud7
48
vulnerability VCID-wgdv-etcq-3qhw
49
vulnerability VCID-xg74-3h1h-kqaf
50
vulnerability VCID-y6gd-vy49-17b4
51
vulnerability VCID-y8et-m846-2fc6
52
vulnerability VCID-z28b-1yrx-1bbn
53
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4-rc1
3
url pkg:composer/silverstripe/framework@3.2.4
purl pkg:composer/silverstripe/framework@3.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-y6gd-vy49-17b4
48
vulnerability VCID-y8et-m846-2fc6
49
vulnerability VCID-z28b-1yrx-1bbn
50
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4
4
url pkg:composer/silverstripe/framework@3.3.2-rc1
purl pkg:composer/silverstripe/framework@3.3.2-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9ugf-duna-xfgy
16
vulnerability VCID-9y5u-qyzd-3ud9
17
vulnerability VCID-a7cf-kpzy-xudd
18
vulnerability VCID-at1s-qxsg-5yfs
19
vulnerability VCID-b6nm-cphj-wfgw
20
vulnerability VCID-b95v-49p7-fkas
21
vulnerability VCID-c437-w2zy-y7c9
22
vulnerability VCID-c6bz-jwhm-vkgp
23
vulnerability VCID-cmwn-cjff-9qau
24
vulnerability VCID-czh2-w6fk-xqd6
25
vulnerability VCID-ewg1-jqza-eyez
26
vulnerability VCID-excr-b2pz-jydm
27
vulnerability VCID-gkkp-9fm7-jfaz
28
vulnerability VCID-gnpw-s9hp-wqfs
29
vulnerability VCID-hcuz-gz3w-97ew
30
vulnerability VCID-hnme-cqff-c7dp
31
vulnerability VCID-k46z-g6jp-57ek
32
vulnerability VCID-ky21-z2d2-sye6
33
vulnerability VCID-mkex-ht2r-cucz
34
vulnerability VCID-n1mj-u4yk-jqhn
35
vulnerability VCID-n4fk-735u-2baw
36
vulnerability VCID-nute-ndg2-z7ev
37
vulnerability VCID-pkve-yjqy-syc2
38
vulnerability VCID-qdwg-f2bx-1bay
39
vulnerability VCID-qj5k-bcw3-5fgq
40
vulnerability VCID-qmfy-dxag-uuex
41
vulnerability VCID-r1eg-dwej-5kau
42
vulnerability VCID-sg62-98yy-2kd7
43
vulnerability VCID-t81f-5b8z-hyht
44
vulnerability VCID-tv7h-289s-xub4
45
vulnerability VCID-umhc-fdfh-1fdx
46
vulnerability VCID-uy47-3s8a-hbdn
47
vulnerability VCID-v9ch-up34-nuab
48
vulnerability VCID-vatg-guxu-2ud7
49
vulnerability VCID-wgdv-etcq-3qhw
50
vulnerability VCID-xg74-3h1h-kqaf
51
vulnerability VCID-y6gd-vy49-17b4
52
vulnerability VCID-y8et-m846-2fc6
53
vulnerability VCID-z28b-1yrx-1bbn
54
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2-rc1
5
url pkg:composer/silverstripe/framework@3.3.2
purl pkg:composer/silverstripe/framework@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-f4hv-79km-3ygt
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-vatg-guxu-2ud7
47
vulnerability VCID-wgdv-etcq-3qhw
48
vulnerability VCID-xg74-3h1h-kqaf
49
vulnerability VCID-y6gd-vy49-17b4
50
vulnerability VCID-y8et-m846-2fc6
51
vulnerability VCID-z28b-1yrx-1bbn
52
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2
aliases SS-2016-005
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-evh4-xq48-4fa6
3
url VCID-excr-b2pz-jydm
vulnerability_id VCID-excr-b2pz-jydm
summary 
Silverstripe Brute force bypass on default admin
Default Administrator accounts were not subject to the same brute force protection afforded to other Member accounts. Failed login counts were not logged for default admins resulting in unlimited attempts on the default admin username and password.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-005-1.yaml
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-005-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/f32c893546340c8c279fd1ab6d4269e9d6539bc2
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/f32c893546340c8c279fd1ab6d4269e9d6539bc2
3
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-005
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-005
4
reference_url https://github.com/advisories/GHSA-8v6m-7f5v-hhx6
reference_id GHSA-8v6m-7f5v-hhx6
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8v6m-7f5v-hhx6
fixed_packages
0
url pkg:composer/silverstripe/framework@3.1.19
purl pkg:composer/silverstripe/framework@3.1.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-xsgv-a7bd-fqh8
48
vulnerability VCID-y6gd-vy49-17b4
49
vulnerability VCID-y8et-m846-2fc6
50
vulnerability VCID-z28b-1yrx-1bbn
51
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19
1
url pkg:composer/silverstripe/framework@3.2.4
purl pkg:composer/silverstripe/framework@3.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-y6gd-vy49-17b4
48
vulnerability VCID-y8et-m846-2fc6
49
vulnerability VCID-z28b-1yrx-1bbn
50
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4
2
url pkg:composer/silverstripe/framework@3.3.2
purl pkg:composer/silverstripe/framework@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-f4hv-79km-3ygt
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-vatg-guxu-2ud7
47
vulnerability VCID-wgdv-etcq-3qhw
48
vulnerability VCID-xg74-3h1h-kqaf
49
vulnerability VCID-y6gd-vy49-17b4
50
vulnerability VCID-y8et-m846-2fc6
51
vulnerability VCID-z28b-1yrx-1bbn
52
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2
aliases GHSA-8v6m-7f5v-hhx6
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-excr-b2pz-jydm
4
url VCID-ggbg-8mtc-hudc
vulnerability_id VCID-ggbg-8mtc-hudc
summary 
XSS in CMS Edit Page
Due to a lack of parameter sanitisation a carefully crafted URL could be used to inject arbitrary HTML into the CMS Edit page. An attacker could create a URL and share it with a site administrator to perform an attack.
references
0
reference_url https://github.com/silverstripe/silverstripe-framework/commit/a24c8260b1d048dc6a0836eb1be9a1ca2056e770
reference_id
reference_type
scores
url https://github.com/silverstripe/silverstripe-framework/commit/a24c8260b1d048dc6a0836eb1be9a1ca2056e770
1
reference_url http://www.silverstripe.org/download/security-releases/ss-2016-004
reference_id
reference_type
scores
url http://www.silverstripe.org/download/security-releases/ss-2016-004
fixed_packages
0
url pkg:composer/silverstripe/framework@3.1.19-rc1
purl pkg:composer/silverstripe/framework@3.1.19-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9ugf-duna-xfgy
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-excr-b2pz-jydm
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-v9ch-up34-nuab
47
vulnerability VCID-vatg-guxu-2ud7
48
vulnerability VCID-wgdv-etcq-3qhw
49
vulnerability VCID-xg74-3h1h-kqaf
50
vulnerability VCID-xsgv-a7bd-fqh8
51
vulnerability VCID-y6gd-vy49-17b4
52
vulnerability VCID-y8et-m846-2fc6
53
vulnerability VCID-z28b-1yrx-1bbn
54
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19-rc1
1
url pkg:composer/silverstripe/framework@3.1.19
purl pkg:composer/silverstripe/framework@3.1.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-xsgv-a7bd-fqh8
48
vulnerability VCID-y6gd-vy49-17b4
49
vulnerability VCID-y8et-m846-2fc6
50
vulnerability VCID-z28b-1yrx-1bbn
51
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19
2
url pkg:composer/silverstripe/framework@3.2.4-rc1
purl pkg:composer/silverstripe/framework@3.2.4-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9ugf-duna-xfgy
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-excr-b2pz-jydm
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-v9ch-up34-nuab
47
vulnerability VCID-vatg-guxu-2ud7
48
vulnerability VCID-wgdv-etcq-3qhw
49
vulnerability VCID-xg74-3h1h-kqaf
50
vulnerability VCID-y6gd-vy49-17b4
51
vulnerability VCID-y8et-m846-2fc6
52
vulnerability VCID-z28b-1yrx-1bbn
53
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4-rc1
3
url pkg:composer/silverstripe/framework@3.2.4
purl pkg:composer/silverstripe/framework@3.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-y6gd-vy49-17b4
48
vulnerability VCID-y8et-m846-2fc6
49
vulnerability VCID-z28b-1yrx-1bbn
50
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4
4
url pkg:composer/silverstripe/framework@3.3.2-rc1
purl pkg:composer/silverstripe/framework@3.3.2-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9ugf-duna-xfgy
16
vulnerability VCID-9y5u-qyzd-3ud9
17
vulnerability VCID-a7cf-kpzy-xudd
18
vulnerability VCID-at1s-qxsg-5yfs
19
vulnerability VCID-b6nm-cphj-wfgw
20
vulnerability VCID-b95v-49p7-fkas
21
vulnerability VCID-c437-w2zy-y7c9
22
vulnerability VCID-c6bz-jwhm-vkgp
23
vulnerability VCID-cmwn-cjff-9qau
24
vulnerability VCID-czh2-w6fk-xqd6
25
vulnerability VCID-ewg1-jqza-eyez
26
vulnerability VCID-excr-b2pz-jydm
27
vulnerability VCID-gkkp-9fm7-jfaz
28
vulnerability VCID-gnpw-s9hp-wqfs
29
vulnerability VCID-hcuz-gz3w-97ew
30
vulnerability VCID-hnme-cqff-c7dp
31
vulnerability VCID-k46z-g6jp-57ek
32
vulnerability VCID-ky21-z2d2-sye6
33
vulnerability VCID-mkex-ht2r-cucz
34
vulnerability VCID-n1mj-u4yk-jqhn
35
vulnerability VCID-n4fk-735u-2baw
36
vulnerability VCID-nute-ndg2-z7ev
37
vulnerability VCID-pkve-yjqy-syc2
38
vulnerability VCID-qdwg-f2bx-1bay
39
vulnerability VCID-qj5k-bcw3-5fgq
40
vulnerability VCID-qmfy-dxag-uuex
41
vulnerability VCID-r1eg-dwej-5kau
42
vulnerability VCID-sg62-98yy-2kd7
43
vulnerability VCID-t81f-5b8z-hyht
44
vulnerability VCID-tv7h-289s-xub4
45
vulnerability VCID-umhc-fdfh-1fdx
46
vulnerability VCID-uy47-3s8a-hbdn
47
vulnerability VCID-v9ch-up34-nuab
48
vulnerability VCID-vatg-guxu-2ud7
49
vulnerability VCID-wgdv-etcq-3qhw
50
vulnerability VCID-xg74-3h1h-kqaf
51
vulnerability VCID-y6gd-vy49-17b4
52
vulnerability VCID-y8et-m846-2fc6
53
vulnerability VCID-z28b-1yrx-1bbn
54
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2-rc1
5
url pkg:composer/silverstripe/framework@3.3.2
purl pkg:composer/silverstripe/framework@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-f4hv-79km-3ygt
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-vatg-guxu-2ud7
47
vulnerability VCID-wgdv-etcq-3qhw
48
vulnerability VCID-xg74-3h1h-kqaf
49
vulnerability VCID-y6gd-vy49-17b4
50
vulnerability VCID-y8et-m846-2fc6
51
vulnerability VCID-z28b-1yrx-1bbn
52
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2
aliases SS-2016-004
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ggbg-8mtc-hudc
5
url VCID-m5rs-qptc-vued
vulnerability_id VCID-m5rs-qptc-vued
summary 
Missing CSRF protection in login form
`LoginForm` calls `disableSecurityToken()`, which causes a "shared host domain" vulnerability.
references
0
reference_url https://github.com/silverstripe/silverstripe-framework/commit/a6bd22ab2f3b11a054d20be13306a19089510989
reference_id
reference_type
scores
url https://github.com/silverstripe/silverstripe-framework/commit/a6bd22ab2f3b11a054d20be13306a19089510989
1
reference_url http://stackoverflow.com/a/15350123
reference_id
reference_type
scores
url http://stackoverflow.com/a/15350123
2
reference_url http://www.silverstripe.org/download/security-releases/ss-2016-006
reference_id
reference_type
scores
url http://www.silverstripe.org/download/security-releases/ss-2016-006
fixed_packages
0
url pkg:composer/silverstripe/framework@3.1.19-rc1
purl pkg:composer/silverstripe/framework@3.1.19-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9ugf-duna-xfgy
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-excr-b2pz-jydm
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-v9ch-up34-nuab
47
vulnerability VCID-vatg-guxu-2ud7
48
vulnerability VCID-wgdv-etcq-3qhw
49
vulnerability VCID-xg74-3h1h-kqaf
50
vulnerability VCID-xsgv-a7bd-fqh8
51
vulnerability VCID-y6gd-vy49-17b4
52
vulnerability VCID-y8et-m846-2fc6
53
vulnerability VCID-z28b-1yrx-1bbn
54
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19-rc1
1
url pkg:composer/silverstripe/framework@3.1.19
purl pkg:composer/silverstripe/framework@3.1.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-xsgv-a7bd-fqh8
48
vulnerability VCID-y6gd-vy49-17b4
49
vulnerability VCID-y8et-m846-2fc6
50
vulnerability VCID-z28b-1yrx-1bbn
51
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19
2
url pkg:composer/silverstripe/framework@3.2.4-rc1
purl pkg:composer/silverstripe/framework@3.2.4-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9ugf-duna-xfgy
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-excr-b2pz-jydm
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-v9ch-up34-nuab
47
vulnerability VCID-vatg-guxu-2ud7
48
vulnerability VCID-wgdv-etcq-3qhw
49
vulnerability VCID-xg74-3h1h-kqaf
50
vulnerability VCID-y6gd-vy49-17b4
51
vulnerability VCID-y8et-m846-2fc6
52
vulnerability VCID-z28b-1yrx-1bbn
53
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4-rc1
3
url pkg:composer/silverstripe/framework@3.2.4
purl pkg:composer/silverstripe/framework@3.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-y6gd-vy49-17b4
48
vulnerability VCID-y8et-m846-2fc6
49
vulnerability VCID-z28b-1yrx-1bbn
50
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4
4
url pkg:composer/silverstripe/framework@3.3.2-rc1
purl pkg:composer/silverstripe/framework@3.3.2-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9ugf-duna-xfgy
16
vulnerability VCID-9y5u-qyzd-3ud9
17
vulnerability VCID-a7cf-kpzy-xudd
18
vulnerability VCID-at1s-qxsg-5yfs
19
vulnerability VCID-b6nm-cphj-wfgw
20
vulnerability VCID-b95v-49p7-fkas
21
vulnerability VCID-c437-w2zy-y7c9
22
vulnerability VCID-c6bz-jwhm-vkgp
23
vulnerability VCID-cmwn-cjff-9qau
24
vulnerability VCID-czh2-w6fk-xqd6
25
vulnerability VCID-ewg1-jqza-eyez
26
vulnerability VCID-excr-b2pz-jydm
27
vulnerability VCID-gkkp-9fm7-jfaz
28
vulnerability VCID-gnpw-s9hp-wqfs
29
vulnerability VCID-hcuz-gz3w-97ew
30
vulnerability VCID-hnme-cqff-c7dp
31
vulnerability VCID-k46z-g6jp-57ek
32
vulnerability VCID-ky21-z2d2-sye6
33
vulnerability VCID-mkex-ht2r-cucz
34
vulnerability VCID-n1mj-u4yk-jqhn
35
vulnerability VCID-n4fk-735u-2baw
36
vulnerability VCID-nute-ndg2-z7ev
37
vulnerability VCID-pkve-yjqy-syc2
38
vulnerability VCID-qdwg-f2bx-1bay
39
vulnerability VCID-qj5k-bcw3-5fgq
40
vulnerability VCID-qmfy-dxag-uuex
41
vulnerability VCID-r1eg-dwej-5kau
42
vulnerability VCID-sg62-98yy-2kd7
43
vulnerability VCID-t81f-5b8z-hyht
44
vulnerability VCID-tv7h-289s-xub4
45
vulnerability VCID-umhc-fdfh-1fdx
46
vulnerability VCID-uy47-3s8a-hbdn
47
vulnerability VCID-v9ch-up34-nuab
48
vulnerability VCID-vatg-guxu-2ud7
49
vulnerability VCID-wgdv-etcq-3qhw
50
vulnerability VCID-xg74-3h1h-kqaf
51
vulnerability VCID-y6gd-vy49-17b4
52
vulnerability VCID-y8et-m846-2fc6
53
vulnerability VCID-z28b-1yrx-1bbn
54
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2-rc1
5
url pkg:composer/silverstripe/framework@3.3.2
purl pkg:composer/silverstripe/framework@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-f4hv-79km-3ygt
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-vatg-guxu-2ud7
47
vulnerability VCID-wgdv-etcq-3qhw
48
vulnerability VCID-xg74-3h1h-kqaf
49
vulnerability VCID-y6gd-vy49-17b4
50
vulnerability VCID-y8et-m846-2fc6
51
vulnerability VCID-z28b-1yrx-1bbn
52
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2
aliases SS-2016-006
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-m5rs-qptc-vued
6
url VCID-q939-fszs-wfdp
vulnerability_id VCID-q939-fszs-wfdp
summary 
CSRF vulnerability in savetreenodes
`savetreenode` action does not have sufficient CSRF protection, meaning that in some cases users with CMS access can be tricked into posting unspecified data into the CMS from external websites.
references
0
reference_url https://github.com/silverstripe/silverstripe-framework/commit/3c0f2e8e11a1bead64d869854b9dfc0f80e7579a
reference_id
reference_type
scores
url https://github.com/silverstripe/silverstripe-framework/commit/3c0f2e8e11a1bead64d869854b9dfc0f80e7579a
1
reference_url http://www.silverstripe.org/download/security-releases/ss-2015-029
reference_id
reference_type
scores
url http://www.silverstripe.org/download/security-releases/ss-2015-029
fixed_packages
0
url pkg:composer/silverstripe/framework@3.1.19-rc1
purl pkg:composer/silverstripe/framework@3.1.19-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9ugf-duna-xfgy
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-excr-b2pz-jydm
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-v9ch-up34-nuab
47
vulnerability VCID-vatg-guxu-2ud7
48
vulnerability VCID-wgdv-etcq-3qhw
49
vulnerability VCID-xg74-3h1h-kqaf
50
vulnerability VCID-xsgv-a7bd-fqh8
51
vulnerability VCID-y6gd-vy49-17b4
52
vulnerability VCID-y8et-m846-2fc6
53
vulnerability VCID-z28b-1yrx-1bbn
54
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19-rc1
1
url pkg:composer/silverstripe/framework@3.1.19
purl pkg:composer/silverstripe/framework@3.1.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-xsgv-a7bd-fqh8
48
vulnerability VCID-y6gd-vy49-17b4
49
vulnerability VCID-y8et-m846-2fc6
50
vulnerability VCID-z28b-1yrx-1bbn
51
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19
2
url pkg:composer/silverstripe/framework@3.2.4-rc1
purl pkg:composer/silverstripe/framework@3.2.4-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9ugf-duna-xfgy
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-excr-b2pz-jydm
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-v9ch-up34-nuab
47
vulnerability VCID-vatg-guxu-2ud7
48
vulnerability VCID-wgdv-etcq-3qhw
49
vulnerability VCID-xg74-3h1h-kqaf
50
vulnerability VCID-y6gd-vy49-17b4
51
vulnerability VCID-y8et-m846-2fc6
52
vulnerability VCID-z28b-1yrx-1bbn
53
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4-rc1
3
url pkg:composer/silverstripe/framework@3.2.4
purl pkg:composer/silverstripe/framework@3.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-y6gd-vy49-17b4
48
vulnerability VCID-y8et-m846-2fc6
49
vulnerability VCID-z28b-1yrx-1bbn
50
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4
4
url pkg:composer/silverstripe/framework@3.3.2-rc1
purl pkg:composer/silverstripe/framework@3.3.2-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9ugf-duna-xfgy
16
vulnerability VCID-9y5u-qyzd-3ud9
17
vulnerability VCID-a7cf-kpzy-xudd
18
vulnerability VCID-at1s-qxsg-5yfs
19
vulnerability VCID-b6nm-cphj-wfgw
20
vulnerability VCID-b95v-49p7-fkas
21
vulnerability VCID-c437-w2zy-y7c9
22
vulnerability VCID-c6bz-jwhm-vkgp
23
vulnerability VCID-cmwn-cjff-9qau
24
vulnerability VCID-czh2-w6fk-xqd6
25
vulnerability VCID-ewg1-jqza-eyez
26
vulnerability VCID-excr-b2pz-jydm
27
vulnerability VCID-gkkp-9fm7-jfaz
28
vulnerability VCID-gnpw-s9hp-wqfs
29
vulnerability VCID-hcuz-gz3w-97ew
30
vulnerability VCID-hnme-cqff-c7dp
31
vulnerability VCID-k46z-g6jp-57ek
32
vulnerability VCID-ky21-z2d2-sye6
33
vulnerability VCID-mkex-ht2r-cucz
34
vulnerability VCID-n1mj-u4yk-jqhn
35
vulnerability VCID-n4fk-735u-2baw
36
vulnerability VCID-nute-ndg2-z7ev
37
vulnerability VCID-pkve-yjqy-syc2
38
vulnerability VCID-qdwg-f2bx-1bay
39
vulnerability VCID-qj5k-bcw3-5fgq
40
vulnerability VCID-qmfy-dxag-uuex
41
vulnerability VCID-r1eg-dwej-5kau
42
vulnerability VCID-sg62-98yy-2kd7
43
vulnerability VCID-t81f-5b8z-hyht
44
vulnerability VCID-tv7h-289s-xub4
45
vulnerability VCID-umhc-fdfh-1fdx
46
vulnerability VCID-uy47-3s8a-hbdn
47
vulnerability VCID-v9ch-up34-nuab
48
vulnerability VCID-vatg-guxu-2ud7
49
vulnerability VCID-wgdv-etcq-3qhw
50
vulnerability VCID-xg74-3h1h-kqaf
51
vulnerability VCID-y6gd-vy49-17b4
52
vulnerability VCID-y8et-m846-2fc6
53
vulnerability VCID-z28b-1yrx-1bbn
54
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2-rc1
5
url pkg:composer/silverstripe/framework@3.3.2
purl pkg:composer/silverstripe/framework@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-f4hv-79km-3ygt
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-vatg-guxu-2ud7
47
vulnerability VCID-wgdv-etcq-3qhw
48
vulnerability VCID-xg74-3h1h-kqaf
49
vulnerability VCID-y6gd-vy49-17b4
50
vulnerability VCID-y8et-m846-2fc6
51
vulnerability VCID-z28b-1yrx-1bbn
52
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2
aliases SS-2015-029
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-q939-fszs-wfdp
7
url VCID-v9ch-up34-nuab
vulnerability_id VCID-v9ch-up34-nuab
summary 
Silverstripe Missing CSRF protection in login form
LoginForm calls disableSecurityToken(), which causes a "shared host domain" vulnerability: http://stackoverflow.com/a/15350123.
references
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-006-1.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-006-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/a6bd22ab2f3b11a054d20be13306a19089510989
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/a6bd22ab2f3b11a054d20be13306a19089510989
3
reference_url https://stackoverflow.com/questions/6412813/do-login-forms-need-tokens-against-csrf-attacks/15350123#15350123
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://stackoverflow.com/questions/6412813/do-login-forms-need-tokens-against-csrf-attacks/15350123#15350123
4
reference_url https://www.silverstripe.org/download/security-releases/ss-2016-006
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2016-006
5
reference_url https://github.com/advisories/GHSA-vj2j-6g3w-4662
reference_id GHSA-vj2j-6g3w-4662
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vj2j-6g3w-4662
fixed_packages
0
url pkg:composer/silverstripe/framework@3.1.19
purl pkg:composer/silverstripe/framework@3.1.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-xsgv-a7bd-fqh8
48
vulnerability VCID-y6gd-vy49-17b4
49
vulnerability VCID-y8et-m846-2fc6
50
vulnerability VCID-z28b-1yrx-1bbn
51
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.19
1
url pkg:composer/silverstripe/framework@3.2.4
purl pkg:composer/silverstripe/framework@3.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3x46-q9cb-7ubg
5
vulnerability VCID-4h4a-xgrk-d7ec
6
vulnerability VCID-5cfa-whq6-9ucp
7
vulnerability VCID-79qx-v5uu-jyf2
8
vulnerability VCID-7ek4-6y31-1qcs
9
vulnerability VCID-7hxq-cp29-r7dh
10
vulnerability VCID-7jm4-cjg3-rkcz
11
vulnerability VCID-86vg-4j71-hkgr
12
vulnerability VCID-8u5c-6vx3-mfcr
13
vulnerability VCID-9hf4-djcv-67d7
14
vulnerability VCID-9y5u-qyzd-3ud9
15
vulnerability VCID-a7cf-kpzy-xudd
16
vulnerability VCID-at1s-qxsg-5yfs
17
vulnerability VCID-b6nm-cphj-wfgw
18
vulnerability VCID-b95v-49p7-fkas
19
vulnerability VCID-c437-w2zy-y7c9
20
vulnerability VCID-c6bz-jwhm-vkgp
21
vulnerability VCID-cmwn-cjff-9qau
22
vulnerability VCID-czh2-w6fk-xqd6
23
vulnerability VCID-ewg1-jqza-eyez
24
vulnerability VCID-gkkp-9fm7-jfaz
25
vulnerability VCID-gnpw-s9hp-wqfs
26
vulnerability VCID-hcuz-gz3w-97ew
27
vulnerability VCID-hnme-cqff-c7dp
28
vulnerability VCID-k46z-g6jp-57ek
29
vulnerability VCID-ky21-z2d2-sye6
30
vulnerability VCID-mkex-ht2r-cucz
31
vulnerability VCID-n1mj-u4yk-jqhn
32
vulnerability VCID-n4fk-735u-2baw
33
vulnerability VCID-nute-ndg2-z7ev
34
vulnerability VCID-pkve-yjqy-syc2
35
vulnerability VCID-qdwg-f2bx-1bay
36
vulnerability VCID-qj5k-bcw3-5fgq
37
vulnerability VCID-qmfy-dxag-uuex
38
vulnerability VCID-r1eg-dwej-5kau
39
vulnerability VCID-sg62-98yy-2kd7
40
vulnerability VCID-t81f-5b8z-hyht
41
vulnerability VCID-tv7h-289s-xub4
42
vulnerability VCID-umhc-fdfh-1fdx
43
vulnerability VCID-uy47-3s8a-hbdn
44
vulnerability VCID-vatg-guxu-2ud7
45
vulnerability VCID-wgdv-etcq-3qhw
46
vulnerability VCID-xg74-3h1h-kqaf
47
vulnerability VCID-y6gd-vy49-17b4
48
vulnerability VCID-y8et-m846-2fc6
49
vulnerability VCID-z28b-1yrx-1bbn
50
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4
2
url pkg:composer/silverstripe/framework@3.3.2
purl pkg:composer/silverstripe/framework@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11sx-j3x7-gkcr
1
vulnerability VCID-1mmc-91gk-r3d3
2
vulnerability VCID-1p79-328x-sueq
3
vulnerability VCID-36z3-nafq-6kez
4
vulnerability VCID-3svb-wudn-aybz
5
vulnerability VCID-3x46-q9cb-7ubg
6
vulnerability VCID-4h4a-xgrk-d7ec
7
vulnerability VCID-5cfa-whq6-9ucp
8
vulnerability VCID-79qx-v5uu-jyf2
9
vulnerability VCID-7ek4-6y31-1qcs
10
vulnerability VCID-7hxq-cp29-r7dh
11
vulnerability VCID-7jm4-cjg3-rkcz
12
vulnerability VCID-86vg-4j71-hkgr
13
vulnerability VCID-8u5c-6vx3-mfcr
14
vulnerability VCID-9hf4-djcv-67d7
15
vulnerability VCID-9y5u-qyzd-3ud9
16
vulnerability VCID-a7cf-kpzy-xudd
17
vulnerability VCID-at1s-qxsg-5yfs
18
vulnerability VCID-b6nm-cphj-wfgw
19
vulnerability VCID-b95v-49p7-fkas
20
vulnerability VCID-c437-w2zy-y7c9
21
vulnerability VCID-c6bz-jwhm-vkgp
22
vulnerability VCID-cmwn-cjff-9qau
23
vulnerability VCID-czh2-w6fk-xqd6
24
vulnerability VCID-ewg1-jqza-eyez
25
vulnerability VCID-f4hv-79km-3ygt
26
vulnerability VCID-gkkp-9fm7-jfaz
27
vulnerability VCID-gnpw-s9hp-wqfs
28
vulnerability VCID-hcuz-gz3w-97ew
29
vulnerability VCID-hnme-cqff-c7dp
30
vulnerability VCID-k46z-g6jp-57ek
31
vulnerability VCID-ky21-z2d2-sye6
32
vulnerability VCID-mkex-ht2r-cucz
33
vulnerability VCID-n1mj-u4yk-jqhn
34
vulnerability VCID-n4fk-735u-2baw
35
vulnerability VCID-nute-ndg2-z7ev
36
vulnerability VCID-pkve-yjqy-syc2
37
vulnerability VCID-qdwg-f2bx-1bay
38
vulnerability VCID-qj5k-bcw3-5fgq
39
vulnerability VCID-qmfy-dxag-uuex
40
vulnerability VCID-r1eg-dwej-5kau
41
vulnerability VCID-sg62-98yy-2kd7
42
vulnerability VCID-t81f-5b8z-hyht
43
vulnerability VCID-tv7h-289s-xub4
44
vulnerability VCID-umhc-fdfh-1fdx
45
vulnerability VCID-uy47-3s8a-hbdn
46
vulnerability VCID-vatg-guxu-2ud7
47
vulnerability VCID-wgdv-etcq-3qhw
48
vulnerability VCID-xg74-3h1h-kqaf
49
vulnerability VCID-y6gd-vy49-17b4
50
vulnerability VCID-y8et-m846-2fc6
51
vulnerability VCID-z28b-1yrx-1bbn
52
vulnerability VCID-zdge-zsmz-8ud9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.3.2
aliases GHSA-vj2j-6g3w-4662
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v9ch-up34-nuab
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.4