Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/6927?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/6927?format=api", "purl": "pkg:pypi/plone@4.3.3", "type": "pypi", "namespace": "", "name": "plone", "version": "4.3.3", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "5.2.5", "latest_non_vulnerable_version": "6.0.7", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7830?format=api", "vulnerability_id": "VCID-2jxf-hfxq-skg7", "summary": "A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7941", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00619", "scoring_system": "epss", "scoring_elements": "0.70352", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7941" }, { "reference_url": "https://github.com/plone/plone.app.contenttypes", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/plone.app.contenttypes" }, { "reference_url": "https://github.com/plone/plone.app.contenttypes/blob/master/CHANGES.rst?plain=1#L372-L374", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/plone.app.contenttypes/blob/master/CHANGES.rst?plain=1#L372-L374" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-90.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-90.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7941", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7941" }, { "reference_url": "https://plone.org/security/hotfix/20200121", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20200121" }, { "reference_url": "https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2020/01/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.openwall.com/lists/oss-security/2020/01/22/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2020/01/24/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2020/01/24/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13656?format=api", "purl": "pkg:pypi/plone@5.2.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2" } ], "aliases": [ "CVE-2020-7941", "GHSA-w6g9-xccc-347h", "PYSEC-2020-90" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2jxf-hfxq-skg7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7523?format=api", "vulnerability_id": "VCID-311f-xecp-47fm", "summary": "Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000483", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00294", "scoring_system": "epss", "scoring_elements": "0.52982", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000483" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-72.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-72.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20171128/sandbox-escape", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20171128/sandbox-escape" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000483", "reference_id": "CVE-2017-1000483", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000483" }, { "reference_url": "https://github.com/advisories/GHSA-qc57-h2f7-p4hx", "reference_id": "GHSA-qc57-h2f7-p4hx", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qc57-h2f7-p4hx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8493?format=api", "purl": "pkg:pypi/plone@4.3.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16" }, { "url": "http://public2.vulnerablecode.io/api/packages/9366?format=api", "purl": "pkg:pypi/plone@5.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0" } ], "aliases": [ "CVE-2017-1000483", "GHSA-qc57-h2f7-p4hx", "PYSEC-2018-72" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-311f-xecp-47fm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7397?format=api", "vulnerability_id": "VCID-36rb-6jkw-j7d8", "summary": "Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions.", "references": [ { "reference_url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7135", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.007", "scoring_system": "epss", "scoring_elements": "0.72335", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7135" }, { "reference_url": "http://seclists.org/fulldisclosure/2016/Oct/80", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2016/Oct/80" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-58.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-58.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20160830/filesystem-information-leak", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20160830/filesystem-information-leak" }, { "reference_url": "https://pypi.org/project/Products.PloneHotfix20160830", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://pypi.org/project/Products.PloneHotfix20160830" }, { "reference_url": "https://web.archive.org/web/20200227230348/http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20200227230348/http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://web.archive.org/web/20201207134911/http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20201207134911/http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/5" }, { "reference_url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7135", "reference_id": "CVE-2016-7135", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7135" }, { "reference_url": "https://github.com/advisories/GHSA-m7f9-65wr-pwch", "reference_id": "GHSA-m7f9-65wr-pwch", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-m7f9-65wr-pwch" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8399?format=api", "purl": "pkg:pypi/plone@4.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/8400?format=api", "purl": "pkg:pypi/plone@5.0.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7" } ], "aliases": [ "CVE-2016-7135", "GHSA-m7f9-65wr-pwch", "PYSEC-2017-58" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-36rb-6jkw-j7d8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8028?format=api", "vulnerability_id": "VCID-36xh-ua3s-gyfr", "summary": "Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-28736", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00484", "scoring_system": "epss", "scoring_elements": "0.65579", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-28736" }, { "reference_url": "https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt" }, { "reference_url": "https://github.com/advisories/GHSA-2c8c-84w2-j38j", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2c8c-84w2-j38j" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/issues/3209", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/issues/3209" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-248.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-248.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28736", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28736" }, { "reference_url": "https://www.misakikata.com/codes/plone/python-en.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.misakikata.com/codes/plone/python-en.html" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/18282?format=api", "purl": "pkg:pypi/plone@5.2.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-ccuu-86vs-s3gs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.3" } ], "aliases": [ "CVE-2020-28736", "GHSA-2c8c-84w2-j38j", "PYSEC-2020-248" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-36xh-ua3s-gyfr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8094?format=api", "vulnerability_id": "VCID-3n34-5rm7-nbcj", "summary": "Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33510", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0012", "scoring_system": "epss", "scoring_elements": "0.30603", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33510" }, { "reference_url": "https://github.com/advisories/GHSA-4mg4-wvmx-5332", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4mg4-wvmx-5332" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-82.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-82.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33510", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33510" }, { "reference_url": "https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/05/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2021/05/22/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20801?format=api", "purl": "pkg:pypi/plone@5.2.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5" } ], "aliases": [ "CVE-2021-33510", "GHSA-4mg4-wvmx-5332", "PYSEC-2021-82" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3n34-5rm7-nbcj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7832?format=api", "vulnerability_id": "VCID-3s9q-6gvu-qyef", "summary": "Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7940", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0034", "scoring_system": "epss", "scoring_elements": "0.56976", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7940" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-89.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-89.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7940", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7940" }, { "reference_url": "https://plone.org/security/hotfix/20200121", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20200121" }, { "reference_url": "https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2020/01/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.openwall.com/lists/oss-security/2020/01/22/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2020/01/24/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2020/01/24/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8497?format=api", "purl": "pkg:pypi/plone@4.3.20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.20" }, { "url": "http://public2.vulnerablecode.io/api/packages/13663?format=api", "purl": "pkg:pypi/plone@5.1.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/13655?format=api", "purl": "pkg:pypi/plone@5.2.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-hmam-sbwn-afh2" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/13656?format=api", "purl": "pkg:pypi/plone@5.2.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2" } ], "aliases": [ "CVE-2020-7940", "GHSA-cw58-gpgw-hwx2", "PYSEC-2020-89" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3s9q-6gvu-qyef" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7522?format=api", "vulnerability_id": "VCID-43m1-jkv8-jygp", "summary": "A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000482", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00287", "scoring_system": "epss", "scoring_elements": "0.52428", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000482" }, { "reference_url": "https://github.com/plone/Products.CMFPlone", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/issues/2232", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/issues/2232" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2233", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2233" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2234", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2234" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2235", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2235" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2236", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2236" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-71.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-71.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000482", "reference_id": "CVE-2017-1000482", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000482" }, { "reference_url": "https://github.com/advisories/GHSA-859j-668v-mrr6", "reference_id": "GHSA-859j-668v-mrr6", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-859j-668v-mrr6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8493?format=api", "purl": "pkg:pypi/plone@4.3.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16" }, { "url": "http://public2.vulnerablecode.io/api/packages/9366?format=api", "purl": "pkg:pypi/plone@5.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0" } ], "aliases": [ "CVE-2017-1000482", "GHSA-859j-668v-mrr6", "PYSEC-2018-71" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-43m1-jkv8-jygp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7473?format=api", "vulnerability_id": "VCID-4bjr-mjug-gqd2", "summary": "Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7315", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00436", "scoring_system": "epss", "scoring_elements": "0.63273", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7315" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1264791", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1264791" }, { "reference_url": "https://github.com/plone/Products.CMFPlone", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/1845b0a92312291811b68907bf2aa0fb448c4016", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/1845b0a92312291811b68907bf2aa0fb448c4016" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/9f0111f85cd14f3f067044b59b93e2856c99d542", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/9f0111f85cd14f3f067044b59b93e2856c99d542" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-52.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-52.yaml" }, { "reference_url": "https://github.com/zopefoundation/Products.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zopefoundation/Products.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7315", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7315" }, { "reference_url": "https://plone.org/security/20150910", "reference_id": "", "reference_type": "", "scores": [], "url": "https://plone.org/security/20150910" }, { "reference_url": "https://plone.org/security/20150910/anonymous-is-able-to-create-plone-members", "reference_id": "", "reference_type": "", "scores": [], "url": "https://plone.org/security/20150910/anonymous-is-able-to-create-plone-members" }, { "reference_url": "https://plone.org/security/hotfix/20150910/anonymous-is-able-to-create-plone-members", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20150910/anonymous-is-able-to-create-plone-members" }, { "reference_url": "https://pypi.org/project/Products.PloneHotfix20150910", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://pypi.org/project/Products.PloneHotfix20150910" }, { "reference_url": "https://pypi.python.org/pypi/Products.PloneHotfix20150910", "reference_id": "", "reference_type": "", "scores": [], "url": "https://pypi.python.org/pypi/Products.PloneHotfix20150910" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2015/09/22/13", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2015/09/22/13" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8387?format=api", "purl": "pkg:pypi/plone@4.3.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/8483?format=api", "purl": "pkg:pypi/plone@5.0rc2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0rc2" } ], "aliases": [ "CVE-2015-7315", "GHSA-984m-rj28-8c6x", "PYSEC-2017-52" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4bjr-mjug-gqd2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8095?format=api", "vulnerability_id": "VCID-5e2c-6mkx-4udu", "summary": "Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33511", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00276", "scoring_system": "epss", "scoring_elements": "0.51216", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33511" }, { "reference_url": "https://github.com/advisories/GHSA-gc9g-67cq-p7v4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gc9g-67cq-p7v4" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-83.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-83.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33511", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33511" }, { "reference_url": "https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/05/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2021/05/22/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20801?format=api", "purl": "pkg:pypi/plone@5.2.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5" } ], "aliases": [ "CVE-2021-33511", "GHSA-gc9g-67cq-p7v4", "PYSEC-2021-83" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5e2c-6mkx-4udu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7401?format=api", "vulnerability_id": "VCID-5kaj-zugj-mbh1", "summary": "Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.", "references": [ { "reference_url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7140", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00491", "scoring_system": "epss", "scoring_elements": "0.65908", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7140" }, { "reference_url": "http://seclists.org/fulldisclosure/2016/Oct/80", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2016/Oct/80" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-63.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-63.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20160830/non-persistent-xss-in-zope2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20160830/non-persistent-xss-in-zope2" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/5" }, { "reference_url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7140", "reference_id": "CVE-2016-7140", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7140" }, { "reference_url": "https://github.com/advisories/GHSA-chvw-gjxf-f8mc", "reference_id": "GHSA-chvw-gjxf-f8mc", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-chvw-gjxf-f8mc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8399?format=api", "purl": "pkg:pypi/plone@4.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/8400?format=api", "purl": "pkg:pypi/plone@5.0.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7" } ], "aliases": [ "CVE-2016-7140", "GHSA-chvw-gjxf-f8mc", "PYSEC-2017-63" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5kaj-zugj-mbh1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7477?format=api", "vulnerability_id": "VCID-5tbn-qmuj-jya9", "summary": "Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.", "references": [ { "reference_url": "http://hyp3rlinx.altervista.org/advisories/AS-ZOPE-CSRF.txt", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://hyp3rlinx.altervista.org/advisories/AS-ZOPE-CSRF.txt" }, { "reference_url": "http://packetstormsecurity.com/files/133889/Zope-Management-Interface-4.3.7-Cross-Site-Request-Forgery.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/133889/Zope-Management-Interface-4.3.7-Cross-Site-Request-Forgery.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7293", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00332", "scoring_system": "epss", "scoring_elements": "0.56335", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7293" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-51.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-51.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7293", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7293" }, { "reference_url": "https://plone.org/security/hotfix/20151006", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20151006" }, { "reference_url": "https://pypi.python.org/pypi/plone4.csrffixes", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://pypi.python.org/pypi/plone4.csrffixes" }, { "reference_url": "https://www.exploit-db.com/exploits/38411", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.exploit-db.com/exploits/38411" }, { "reference_url": "https://www.exploit-db.com/exploits/38411/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.exploit-db.com/exploits/38411/" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/python/webapps/38411.txt", "reference_id": "CVE-2015-7293;OSVDB-128533;OSVDB-128532", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/python/webapps/38411.txt" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8498?format=api", "purl": "pkg:pypi/plone@5.0a1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-4bjr-mjug-gqd2" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-yaa8-vy4x-cqbq" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0a1" } ], "aliases": [ "CVE-2015-7293", "GHSA-p3qm-44cf-f8qx", "PYSEC-2017-51" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5tbn-qmuj-jya9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8027?format=api", "vulnerability_id": "VCID-5z33-3pqj-gygw", "summary": "Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-28734", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00484", "scoring_system": "epss", "scoring_elements": "0.65579", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-28734" }, { "reference_url": "https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt" }, { "reference_url": "https://github.com/advisories/GHSA-wq6x-g685-w5f2", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wq6x-g685-w5f2" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/issues/3209", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/issues/3209" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-246.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-246.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28734", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28734" }, { "reference_url": "https://www.misakikata.com/codes/plone/python-en.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.misakikata.com/codes/plone/python-en.html" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/18282?format=api", "purl": "pkg:pypi/plone@5.2.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-ccuu-86vs-s3gs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.3" } ], "aliases": [ "CVE-2020-28734", "GHSA-wq6x-g685-w5f2", "PYSEC-2020-246" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5z33-3pqj-gygw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7389?format=api", "vulnerability_id": "VCID-6898-z4k5-h3b6", "summary": "Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7147", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00299", "scoring_system": "epss", "scoring_elements": "0.53489", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7147" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-64.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-64.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7147", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7147" }, { "reference_url": "https://plone.org/security/hotfix/20170117", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20170117" }, { "reference_url": "https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2" }, { "reference_url": "https://web.archive.org/web/20170214002551/http://www.securityfocus.com/bid/96117", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20170214002551/http://www.securityfocus.com/bid/96117" }, { "reference_url": "https://www.curesec.com/blog/article/blog/Plone-XSS-186.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.curesec.com/blog/article/blog/Plone-XSS-186.html" }, { "reference_url": "http://www.curesec.com/blog/article/blog/Plone-XSS-186.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.curesec.com/blog/article/blog/Plone-XSS-186.html" }, { "reference_url": "http://www.securityfocus.com/bid/96117", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/96117" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8399?format=api", "purl": "pkg:pypi/plone@4.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/8400?format=api", "purl": "pkg:pypi/plone@5.0.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7" } ], "aliases": [ "CVE-2016-7147", "GHSA-84jm-cpc5-c7g7", "PYSEC-2017-64" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6898-z4k5-h3b6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8100?format=api", "vulnerability_id": "VCID-9ze6-mfrw-ukdv", "summary": "Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33513", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00302", "scoring_system": "epss", "scoring_elements": "0.53803", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33513" }, { "reference_url": "https://github.com/advisories/GHSA-fj67-w3m4-rfmp", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fj67-w3m4-rfmp" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-85.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-85.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33513", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33513" }, { "reference_url": "https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/05/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2021/05/22/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20801?format=api", "purl": "pkg:pypi/plone@5.2.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5" } ], "aliases": [ "CVE-2021-33513", "GHSA-fj67-w3m4-rfmp", "PYSEC-2021-85" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9ze6-mfrw-ukdv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8097?format=api", "vulnerability_id": "VCID-d68e-uehc-nudc", "summary": "Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33509", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00846", "scoring_system": "epss", "scoring_elements": "0.75136", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33509" }, { "reference_url": "https://github.com/advisories/GHSA-hm2p-fhwx-9285", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "value": "9.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hm2p-fhwx-9285" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "value": "9.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-81.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "value": "9.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-81.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33509", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "value": "9.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33509" }, { "reference_url": "https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-script", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "value": "9.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-script" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/05/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "value": "9.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2021/05/22/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20801?format=api", "purl": "pkg:pypi/plone@5.2.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5" } ], "aliases": [ "CVE-2021-33509", "GHSA-hm2p-fhwx-9285", "PYSEC-2021-81" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-d68e-uehc-nudc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7524?format=api", "vulnerability_id": "VCID-fga8-ymex-67fw", "summary": "By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000484", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41478", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000484" }, { "reference_url": "https://github.com/advisories/GHSA-xvwv-6wvx-px9x", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xvwv-6wvx-px9x" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/issues/2232", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/issues/2232" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-73.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-73.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000484", "reference_id": "CVE-2017-1000484", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000484" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8493?format=api", "purl": "pkg:pypi/plone@4.3.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16" }, { "url": "http://public2.vulnerablecode.io/api/packages/9366?format=api", "purl": "pkg:pypi/plone@5.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0" } ], "aliases": [ "CVE-2017-1000484", "GHSA-xvwv-6wvx-px9x", "PYSEC-2018-73" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fga8-ymex-67fw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7831?format=api", "vulnerability_id": "VCID-gejv-h449-13e4", "summary": "An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7936", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0034", "scoring_system": "epss", "scoring_elements": "0.56966", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7936" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-85.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-85.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7936", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7936" }, { "reference_url": "https://plone.org/security/hotfix/20200121", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20200121" }, { "reference_url": "https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2020/01/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.openwall.com/lists/oss-security/2020/01/22/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2020/01/24/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2020/01/24/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8497?format=api", "purl": "pkg:pypi/plone@4.3.20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.20" }, { "url": "http://public2.vulnerablecode.io/api/packages/13663?format=api", "purl": "pkg:pypi/plone@5.1.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/13656?format=api", "purl": "pkg:pypi/plone@5.2.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2" } ], "aliases": [ "CVE-2020-7936", "GHSA-82j9-wfcf-9v2h", "PYSEC-2020-85" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gejv-h449-13e4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7395?format=api", "vulnerability_id": "VCID-gsnt-c1cd-d3bf", "summary": "Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-4042", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0023", "scoring_system": "epss", "scoring_elements": "0.45904", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-4042" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-56.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-56.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4042", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4042" }, { "reference_url": "https://plone.org/security/hotfix/20160419/unauthorized-disclosure-of-site-content", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20160419/unauthorized-disclosure-of-site-content" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/04/20/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/04/20/2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8390?format=api", "purl": "pkg:pypi/plone@4.3.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.10" }, { "url": "http://public2.vulnerablecode.io/api/packages/8397?format=api", "purl": "pkg:pypi/plone@5.0.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/8489?format=api", "purl": "pkg:pypi/plone@5.1a2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1a2" } ], "aliases": [ "CVE-2016-4042", "GHSA-v4vj-49m5-wjhw", "PYSEC-2017-56" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gsnt-c1cd-d3bf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7402?format=api", "vulnerability_id": "VCID-m91w-vguw-qkem", "summary": "Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.", "references": [ { "reference_url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7138", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00491", "scoring_system": "epss", "scoring_elements": "0.65908", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7138" }, { "reference_url": "http://seclists.org/fulldisclosure/2016/Oct/80", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2016/Oct/80" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-61.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-61.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-1" }, { "reference_url": "https://web.archive.org/web/20210625091607/http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210625091607/http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://web.archive.org/web/20210625092107/http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210625092107/http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/5" }, { "reference_url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7138", "reference_id": "CVE-2016-7138", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7138" }, { "reference_url": "https://github.com/advisories/GHSA-v3hp-f8qr-cf3p", "reference_id": "GHSA-v3hp-f8qr-cf3p", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-v3hp-f8qr-cf3p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8399?format=api", "purl": "pkg:pypi/plone@4.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/8400?format=api", "purl": "pkg:pypi/plone@5.0.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7" } ], "aliases": [ "CVE-2016-7138", "GHSA-v3hp-f8qr-cf3p", "PYSEC-2017-61" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m91w-vguw-qkem" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7398?format=api", "vulnerability_id": "VCID-njnv-5cwt-4ygy", "summary": "Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions or (2) folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions or the (3) came_from parameter to /login_form.", "references": [ { "reference_url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7137", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00477", "scoring_system": "epss", "scoring_elements": "0.65213", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7137" }, { "reference_url": "http://seclists.org/fulldisclosure/2016/Oct/80", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2016/Oct/80" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-60.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-60.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20160830/open-redirection-in-plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20160830/open-redirection-in-plone" }, { "reference_url": "https://web.archive.org/web/20210625091607/http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210625091607/http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://web.archive.org/web/20210625092107/http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210625092107/http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/5" }, { "reference_url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7137", "reference_id": "CVE-2016-7137", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7137" }, { "reference_url": "https://github.com/advisories/GHSA-69vh-662j-v988", "reference_id": "GHSA-69vh-662j-v988", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-69vh-662j-v988" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8399?format=api", "purl": "pkg:pypi/plone@4.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/8400?format=api", "purl": "pkg:pypi/plone@5.0.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7" } ], "aliases": [ "CVE-2016-7137", "GHSA-69vh-662j-v988", "PYSEC-2017-60" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-njnv-5cwt-4ygy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8098?format=api", "vulnerability_id": "VCID-pv2n-2y41-pbg5", "summary": "Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33507", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00285", "scoring_system": "epss", "scoring_elements": "0.52225", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33507" }, { "reference_url": "https://github.com/advisories/GHSA-35rg-466w-77h3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-35rg-466w-77h3" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-79.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-79.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33507", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33507" }, { "reference_url": "https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/05/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2021/05/22/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20801?format=api", "purl": "pkg:pypi/plone@5.2.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5" } ], "aliases": [ "CVE-2021-33507", "GHSA-35rg-466w-77h3", "PYSEC-2021-79" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pv2n-2y41-pbg5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8717?format=api", "vulnerability_id": "VCID-r61f-p8nh-2bax", "summary": "An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33926", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00501", "scoring_system": "epss", "scoring_elements": "0.66328", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33926" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2023-289.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2023-289.yaml" }, { "reference_url": "https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-19T14:12:55Z/" } ], "url": "https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf" }, { "reference_url": "https://plone.org/security/hotfix/20210518", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-19T14:12:55Z/" } ], "url": "https://plone.org/security/hotfix/20210518" }, { "reference_url": "https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-url", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-19T14:12:55Z/" } ], "url": "https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-url" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33926", "reference_id": "CVE-2021-33926", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33926" }, { "reference_url": "https://github.com/advisories/GHSA-47p5-p3jw-w78w", "reference_id": "GHSA-47p5-p3jw-w78w", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-47p5-p3jw-w78w" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20801?format=api", "purl": "pkg:pypi/plone@5.2.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5" } ], "aliases": [ "CVE-2021-33926", "GHSA-47p5-p3jw-w78w", "PYSEC-2023-289" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "7.9", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r61f-p8nh-2bax" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8096?format=api", "vulnerability_id": "VCID-r874-3h26-j3fp", "summary": "Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33508", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00272", "scoring_system": "epss", "scoring_elements": "0.5084", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33508" }, { "reference_url": "https://github.com/advisories/GHSA-rmpv-rcp6-v8wc", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rmpv-rcp6-v8wc" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-80.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-80.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33508", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33508" }, { "reference_url": "https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/05/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2021/05/22/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20801?format=api", "purl": "pkg:pypi/plone@5.2.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5" } ], "aliases": [ "CVE-2021-33508", "GHSA-rmpv-rcp6-v8wc", "PYSEC-2021-80" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r874-3h26-j3fp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7394?format=api", "vulnerability_id": "VCID-s5ab-nud4-5qdg", "summary": "Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-4041", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62764", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-4041" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-55.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-55.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4041", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4041" }, { "reference_url": "https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/04/20/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/04/20/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8390?format=api", "purl": "pkg:pypi/plone@4.3.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.10" }, { "url": "http://public2.vulnerablecode.io/api/packages/8397?format=api", "purl": "pkg:pypi/plone@5.0.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/8489?format=api", "purl": "pkg:pypi/plone@5.1a2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1a2" } ], "aliases": [ "CVE-2016-4041", "GHSA-qqgj-22gr-73vx", "PYSEC-2017-55" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-s5ab-nud4-5qdg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8092?format=api", "vulnerability_id": "VCID-sa7x-wvn1-skh1", "summary": "Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3313", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00444", "scoring_system": "epss", "scoring_elements": "0.6367", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3313" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-78.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-78.yaml" }, { "reference_url": "https://plone.org/download/releases/5.2.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/download/releases/5.2.3" }, { "reference_url": "https://plone.org/security/hotfix/20210518", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20210518" }, { "reference_url": "https://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html" }, { "reference_url": "https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname" }, { "reference_url": "https://www.compass-security.com/fileadmin/Research/Advisories/2021-07_CSNC-2021-013_XSS_in_Plone_CMS.txt", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.compass-security.com/fileadmin/Research/Advisories/2021-07_CSNC-2021-013_XSS_in_Plone_CMS.txt" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/05/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2021/05/22/1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3313", "reference_id": "CVE-2021-3313", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3313" }, { "reference_url": "https://github.com/advisories/GHSA-hprr-4vfq-fcxw", "reference_id": "GHSA-hprr-4vfq-fcxw", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hprr-4vfq-fcxw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20765?format=api", "purl": "pkg:pypi/plone@5.2.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.4" } ], "aliases": [ "CVE-2021-3313", "GHSA-hprr-4vfq-fcxw", "PYSEC-2021-78" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sa7x-wvn1-skh1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7400?format=api", "vulnerability_id": "VCID-sg6k-wdwq-9bgd", "summary": "z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request.", "references": [ { "reference_url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7136", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00498", "scoring_system": "epss", "scoring_elements": "0.66183", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7136" }, { "reference_url": "http://seclists.org/fulldisclosure/2016/Oct/80", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2016/Oct/80" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-59.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-59.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-forms", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-forms" }, { "reference_url": "https://web.archive.org/web/20210625091607/http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210625091607/http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://web.archive.org/web/20210625092107/http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210625092107/http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/5" }, { "reference_url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7136", "reference_id": "CVE-2016-7136", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7136" }, { "reference_url": "https://github.com/advisories/GHSA-22jm-p2vv-j2hc", "reference_id": "GHSA-22jm-p2vv-j2hc", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-22jm-p2vv-j2hc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8399?format=api", "purl": "pkg:pypi/plone@4.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/8400?format=api", "purl": "pkg:pypi/plone@5.0.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7" } ], "aliases": [ "CVE-2016-7136", "GHSA-22jm-p2vv-j2hc", "PYSEC-2017-59" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sg6k-wdwq-9bgd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8099?format=api", "vulnerability_id": "VCID-tfmu-7tad-xbbe", "summary": "Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33512", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00302", "scoring_system": "epss", "scoring_elements": "0.53803", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33512" }, { "reference_url": "https://github.com/advisories/GHSA-hm2h-f456-6j88", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hm2h-f456-6j88" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-84.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-84.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33512", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33512" }, { "reference_url": "https://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/05/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2021/05/22/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20801?format=api", "purl": "pkg:pypi/plone@5.2.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5" } ], "aliases": [ "CVE-2021-33512", "GHSA-hm2h-f456-6j88", "PYSEC-2021-84" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tfmu-7tad-xbbe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7407?format=api", "vulnerability_id": "VCID-ugq4-1vzc-6uh5", "summary": "Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-5524", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00185", "scoring_system": "epss", "scoring_elements": "0.39983", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-5524" }, { "reference_url": "https://github.com/advisories/GHSA-p5wr-vp8g-q5p4", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-p5wr-vp8g-q5p4" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/a7d47692058e10ce89968e7ca4dacbdf44fcad4f", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/a7d47692058e10ce89968e7ca4dacbdf44fcad4f" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/1912", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/1912" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-81.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-81.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20170117/sandbox-escape", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20170117/sandbox-escape" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2017/01/18/6", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2017/01/18/6" }, { "reference_url": "http://www.securityfocus.com/bid/95679", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/95679" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5524", "reference_id": "CVE-2017-5524", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5524" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8399?format=api", "purl": "pkg:pypi/plone@4.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/8400?format=api", "purl": "pkg:pypi/plone@5.0.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/9360?format=api", "purl": "pkg:pypi/plone@5.1b1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1b1" } ], "aliases": [ "CVE-2017-5524", "GHSA-p5wr-vp8g-q5p4", "PYSEC-2017-81" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ugq4-1vzc-6uh5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10781?format=api", "vulnerability_id": "VCID-w2u3-bnqq-mqfz", "summary": "User information disclosure\nA vulnerability allows unauthorized disclosure of registered user information.", "references": [ { "reference_url": "https://plone.org/products/plone/security/advisories/20151208-announcement", "reference_id": "", "reference_type": "", "scores": [], "url": "https://plone.org/products/plone/security/advisories/20151208-announcement" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8388?format=api", "purl": "pkg:pypi/plone@4.3.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.8" }, { "url": "http://public2.vulnerablecode.io/api/packages/8393?format=api", "purl": "pkg:pypi/plone@5.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.1" } ], "aliases": [ "GMS-2015-51" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-w2u3-bnqq-mqfz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7829?format=api", "vulnerability_id": "VCID-wage-1bme-bkgb", "summary": "SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7939", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00405", "scoring_system": "epss", "scoring_elements": "0.61294", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7939" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-88.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-88.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7939", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7939" }, { "reference_url": "https://plone.org/security/hotfix/20200121", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20200121" }, { "reference_url": "https://plone.org/security/hotfix/20200121/sql-injection-in-dtml-or-in-connection-objects", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20200121/sql-injection-in-dtml-or-in-connection-objects" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2020/01/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.openwall.com/lists/oss-security/2020/01/22/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2020/01/24/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2020/01/24/1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13656?format=api", "purl": "pkg:pypi/plone@5.2.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2" } ], "aliases": [ "CVE-2020-7939", "GHSA-hhmf-7rgg-gcw5", "PYSEC-2020-88" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wage-1bme-bkgb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7521?format=api", "vulnerability_id": "VCID-y2bq-cb4v-mke6", "summary": "When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000481", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41478", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000481" }, { "reference_url": "https://github.com/plone/Products.CMFPlone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/issues/2232", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/issues/2232" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2233", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2233" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2234", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2234" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2235", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2235" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2236", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2236" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-70.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-70.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20171128/open-redirection-on-login-form", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20171128/open-redirection-on-login-form" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000481", "reference_id": "CVE-2017-1000481", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000481" }, { "reference_url": "https://github.com/advisories/GHSA-8g72-gq68-6gqh", "reference_id": "GHSA-8g72-gq68-6gqh", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-8g72-gq68-6gqh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8493?format=api", "purl": "pkg:pypi/plone@4.3.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16" }, { "url": "http://public2.vulnerablecode.io/api/packages/9366?format=api", "purl": "pkg:pypi/plone@5.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0" } ], "aliases": [ "CVE-2017-1000481", "GHSA-8g72-gq68-6gqh", "PYSEC-2018-70" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-y2bq-cb4v-mke6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7476?format=api", "vulnerability_id": "VCID-yaa8-vy4x-cqbq", "summary": "Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7316", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0051", "scoring_system": "epss", "scoring_elements": "0.66719", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7316" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1264788", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1264788" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-53.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-53.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7316", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7316" }, { "reference_url": "https://plone.org/security/20150910/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://plone.org/security/20150910/" }, { "reference_url": "https://plone.org/security/20150910/non-persistent-xss-in-plone", "reference_id": "", "reference_type": "", "scores": [], "url": "https://plone.org/security/20150910/non-persistent-xss-in-plone" }, { "reference_url": "https://plone.org/security/hotfix/20150910/non-persistent-xss-in-plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20150910/non-persistent-xss-in-plone" }, { "reference_url": "https://pypi.org/project/Products.PloneHotfix20150910", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://pypi.org/project/Products.PloneHotfix20150910" }, { "reference_url": "https://pypi.python.org/pypi/Products.PloneHotfix20150910", "reference_id": "", "reference_type": "", "scores": [], "url": "https://pypi.python.org/pypi/Products.PloneHotfix20150910" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2015/09/22/14", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2015/09/22/14" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8387?format=api", "purl": "pkg:pypi/plone@4.3.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/8483?format=api", "purl": "pkg:pypi/plone@5.0rc2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0rc2" } ], "aliases": [ "CVE-2015-7316", "GHSA-vf8g-m3vq-6p4p", "PYSEC-2017-53" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yaa8-vy4x-cqbq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7399?format=api", "vulnerability_id": "VCID-ymbd-m6tf-5bap", "summary": "Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.", "references": [ { "reference_url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7139", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00491", "scoring_system": "epss", "scoring_elements": "0.65908", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7139" }, { "reference_url": "http://seclists.org/fulldisclosure/2016/Oct/80", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2016/Oct/80" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-62.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-62.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone" }, { "reference_url": "https://web.archive.org/web/20201207134910/http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20201207134910/http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://web.archive.org/web/20201207134911/http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20201207134911/http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/09/05/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/09/05/5" }, { "reference_url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/archive/1/539572/100/0/threaded" }, { "reference_url": "http://www.securityfocus.com/bid/92752", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/92752" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7139", "reference_id": "CVE-2016-7139", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7139" }, { "reference_url": "https://github.com/advisories/GHSA-pp4c-2692-7f37", "reference_id": "GHSA-pp4c-2692-7f37", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-pp4c-2692-7f37" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8399?format=api", "purl": "pkg:pypi/plone@4.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/8398?format=api", "purl": "pkg:pypi/plone@5.0.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/8400?format=api", "purl": "pkg:pypi/plone@5.0.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-jn3b-smfx-87gg" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7" } ], "aliases": [ "CVE-2016-7139", "GHSA-pp4c-2692-7f37", "PYSEC-2017-62" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ymbd-m6tf-5bap" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8026?format=api", "vulnerability_id": "VCID-z8kt-tf38-eqgc", "summary": "Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-28735", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00484", "scoring_system": "epss", "scoring_elements": "0.65579", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-28735" }, { "reference_url": "https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt" }, { "reference_url": "https://github.com/advisories/GHSA-x7wf-5mjc-6x76", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-x7wf-5mjc-6x76" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/issues/3209", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/issues/3209" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-247.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-247.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28735", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28735" }, { "reference_url": "https://www.misakikata.com/codes/plone/python-en.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.misakikata.com/codes/plone/python-en.html" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/18282?format=api", "purl": "pkg:pypi/plone@5.2.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-ccuu-86vs-s3gs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.3" } ], "aliases": [ "CVE-2020-28735", "GHSA-x7wf-5mjc-6x76", "PYSEC-2020-247" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z8kt-tf38-eqgc" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7240?format=api", "vulnerability_id": "VCID-a67e-svcb-ekhc", "summary": "Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2013-7061", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49424", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-7061" }, { "reference_url": "https://github.com/plone/Products.CMFPlone", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/a6a3e50f759da7e7ca46e50777a35e51f4d8ed48", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/a6a3e50f759da7e7ca46e50777a35e51f4d8ed48" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-66.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-66.yaml" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/products-cmfplone/PYSEC-2014-68.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/products-cmfplone/PYSEC-2014-68.yaml" }, { "reference_url": "https://plone.org/security/20131210/catalogue-exposure", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/20131210/catalogue-exposure" }, { "reference_url": "https://pypi.org/project/Products.PloneHotfix20131210", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://pypi.org/project/Products.PloneHotfix20131210" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2013/12/10/15", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2013/12/10/15" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2013/12/12/3", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2013/12/12/3" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7061", "reference_id": "CVE-2013-7061", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7061" }, { "reference_url": "https://github.com/advisories/GHSA-4vr8-r7qr-fpvq", "reference_id": "GHSA-4vr8-r7qr-fpvq", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-4vr8-r7qr-fpvq" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/6927?format=api", "purl": "pkg:pypi/plone@4.3.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-4bjr-mjug-gqd2" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-yaa8-vy4x-cqbq" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.3" } ], "aliases": [ "CVE-2013-7061", "GHSA-4vr8-r7qr-fpvq", "PYSEC-2014-66", "PYSEC-2014-68" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a67e-svcb-ekhc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7812?format=api", "vulnerability_id": "VCID-pn5z-xdcd-zqd5", "summary": "Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2013-7062", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00763", "scoring_system": "epss", "scoring_elements": "0.73717", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-7062" }, { "reference_url": "http://seclists.org/oss-sec/2013/q4/467", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/oss-sec/2013/q4/467" }, { "reference_url": "http://seclists.org/oss-sec/2013/q4/485", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/oss-sec/2013/q4/485" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89623", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89623" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89627", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89627" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-218.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-218.yaml" }, { "reference_url": "https://plone.org/security/20131210/zope-xss-in-browseridmanager", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/20131210/zope-xss-in-browseridmanager" }, { "reference_url": "https://plone.org/security/20131210/zope-xss-in-OFS", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/20131210/zope-xss-in-OFS" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7062", "reference_id": "CVE-2013-7062", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7062" }, { "reference_url": "https://github.com/advisories/GHSA-4793-w44w-m7xm", "reference_id": "GHSA-4793-w44w-m7xm", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4793-w44w-m7xm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/5876?format=api", "purl": "pkg:pypi/plone@3.3.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-21n6-9mrg-2fdp" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-31m2-mwzq-judc" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3uw2-j3r6-77ch" }, { "vulnerability": "VCID-3v6x-b2g3-fyhq" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-46az-51p2-yfdf" }, { "vulnerability": "VCID-4bjr-mjug-gqd2" }, { "vulnerability": "VCID-4hzn-mj8g-37ew" }, { "vulnerability": "VCID-4xdg-1sku-17cd" }, { "vulnerability": "VCID-4ym2-39bg-dbga" }, { "vulnerability": "VCID-5bnw-ktd3-8qeb" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-6rsz-krhe-q3gz" }, { "vulnerability": "VCID-7mc8-x346-eyaq" }, { "vulnerability": "VCID-83xg-a5v4-4bcw" }, { "vulnerability": "VCID-8gk5-28z6-7bcf" }, { "vulnerability": "VCID-8j8e-z731-7fbz" }, { "vulnerability": "VCID-8md9-zymx-w7cn" }, { "vulnerability": "VCID-8r52-vc7e-f3bc" }, { "vulnerability": "VCID-99bf-ybqh-dfad" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-a628-5uyk-w3ca" }, { "vulnerability": "VCID-a67e-svcb-ekhc" }, { "vulnerability": "VCID-bj9p-4wzt-47cf" }, { "vulnerability": "VCID-ch1t-qmtc-xqfx" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-f2hn-g67h-kfgk" }, { "vulnerability": "VCID-fd6y-2fcd-jbck" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-hzgj-wca9-z3d1" }, { "vulnerability": "VCID-jhc2-yux7-vybj" }, { "vulnerability": "VCID-k34d-p9vb-g7by" }, { "vulnerability": "VCID-kak6-5sps-z3da" }, { "vulnerability": "VCID-kmd1-vu9u-d7g4" }, { "vulnerability": "VCID-kvvr-zc1s-akhn" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-mgpa-1taj-pycj" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pn5z-xdcd-zqd5" }, { "vulnerability": "VCID-pncb-4m8u-hbaw" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-qkv2-qpe2-97cx" }, { "vulnerability": "VCID-qskf-bt81-5bbe" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-rn4s-px1y-7fbc" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-scgs-bz44-ebfk" }, { "vulnerability": "VCID-swq8-17qu-vyfw" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-u1hz-5a2a-ybac" }, { "vulnerability": "VCID-uduq-ujbb-6qd2" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-uv7n-awe5-2fav" }, { "vulnerability": "VCID-vc1v-xsbc-kff1" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-xa5e-bbcv-byg9" }, { "vulnerability": "VCID-xksv-mub7-dyck" }, { "vulnerability": "VCID-xpjk-k6tj-2uba" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-yaa8-vy4x-cqbq" }, { "vulnerability": "VCID-ykg2-qbyr-ayd5" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" }, { "vulnerability": "VCID-zf51-58kf-43bf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@3.3.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/5877?format=api", "purl": "pkg:pypi/plone@4.0a1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-31m2-mwzq-judc" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3uw2-j3r6-77ch" }, { "vulnerability": "VCID-3v6x-b2g3-fyhq" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-46az-51p2-yfdf" }, { "vulnerability": "VCID-4hzn-mj8g-37ew" }, { "vulnerability": "VCID-4xdg-1sku-17cd" }, { "vulnerability": "VCID-4ym2-39bg-dbga" }, { "vulnerability": "VCID-5bnw-ktd3-8qeb" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-6rsz-krhe-q3gz" }, { "vulnerability": "VCID-7mc8-x346-eyaq" }, { "vulnerability": "VCID-83xg-a5v4-4bcw" }, { "vulnerability": "VCID-8gk5-28z6-7bcf" }, { "vulnerability": "VCID-8j8e-z731-7fbz" }, { "vulnerability": "VCID-8md9-zymx-w7cn" }, { "vulnerability": "VCID-8r52-vc7e-f3bc" }, { "vulnerability": "VCID-99bf-ybqh-dfad" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-a628-5uyk-w3ca" }, { "vulnerability": "VCID-a67e-svcb-ekhc" }, { "vulnerability": "VCID-bj9p-4wzt-47cf" }, { "vulnerability": "VCID-ch1t-qmtc-xqfx" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-f2hn-g67h-kfgk" }, { "vulnerability": "VCID-fd6y-2fcd-jbck" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-hzgj-wca9-z3d1" }, { "vulnerability": "VCID-jhc2-yux7-vybj" }, { "vulnerability": "VCID-k34d-p9vb-g7by" }, { "vulnerability": "VCID-kak6-5sps-z3da" }, { "vulnerability": "VCID-kmd1-vu9u-d7g4" }, { "vulnerability": "VCID-kvvr-zc1s-akhn" }, { "vulnerability": "VCID-mgpa-1taj-pycj" }, { "vulnerability": "VCID-pncb-4m8u-hbaw" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-qkv2-qpe2-97cx" }, { "vulnerability": "VCID-qskf-bt81-5bbe" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-rn4s-px1y-7fbc" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-scgs-bz44-ebfk" }, { "vulnerability": "VCID-swq8-17qu-vyfw" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-u1hz-5a2a-ybac" }, { "vulnerability": "VCID-uduq-ujbb-6qd2" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-uv7n-awe5-2fav" }, { "vulnerability": "VCID-vc1v-xsbc-kff1" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-xa5e-bbcv-byg9" }, { "vulnerability": "VCID-xksv-mub7-dyck" }, { "vulnerability": "VCID-xpjk-k6tj-2uba" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ykg2-qbyr-ayd5" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" }, { "vulnerability": "VCID-zf51-58kf-43bf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.0a1" }, { "url": "http://public2.vulnerablecode.io/api/packages/5911?format=api", "purl": "pkg:pypi/plone@4.0.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-31m2-mwzq-judc" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3uw2-j3r6-77ch" }, { "vulnerability": "VCID-3v6x-b2g3-fyhq" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-46az-51p2-yfdf" }, { "vulnerability": "VCID-4bjr-mjug-gqd2" }, { "vulnerability": "VCID-4hzn-mj8g-37ew" }, { "vulnerability": "VCID-4xdg-1sku-17cd" }, { "vulnerability": "VCID-4ym2-39bg-dbga" }, { "vulnerability": "VCID-5bnw-ktd3-8qeb" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-6rsz-krhe-q3gz" }, { "vulnerability": "VCID-7mc8-x346-eyaq" }, { "vulnerability": "VCID-83xg-a5v4-4bcw" }, { "vulnerability": "VCID-8gk5-28z6-7bcf" }, { "vulnerability": "VCID-8j8e-z731-7fbz" }, { "vulnerability": "VCID-8md9-zymx-w7cn" }, { "vulnerability": "VCID-8r52-vc7e-f3bc" }, { "vulnerability": "VCID-99bf-ybqh-dfad" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-a628-5uyk-w3ca" }, { "vulnerability": "VCID-a67e-svcb-ekhc" }, { "vulnerability": "VCID-bj9p-4wzt-47cf" }, { "vulnerability": "VCID-ch1t-qmtc-xqfx" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fd6y-2fcd-jbck" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-hzgj-wca9-z3d1" }, { "vulnerability": "VCID-jhc2-yux7-vybj" }, { "vulnerability": "VCID-k34d-p9vb-g7by" }, { "vulnerability": "VCID-kak6-5sps-z3da" }, { "vulnerability": "VCID-kmd1-vu9u-d7g4" }, { "vulnerability": "VCID-kvvr-zc1s-akhn" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-mgpa-1taj-pycj" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pn5z-xdcd-zqd5" }, { "vulnerability": "VCID-pncb-4m8u-hbaw" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-qkv2-qpe2-97cx" }, { "vulnerability": "VCID-qskf-bt81-5bbe" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-rn4s-px1y-7fbc" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-scgs-bz44-ebfk" }, { "vulnerability": "VCID-swq8-17qu-vyfw" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-u1hz-5a2a-ybac" }, { "vulnerability": "VCID-uduq-ujbb-6qd2" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-uv7n-awe5-2fav" }, { "vulnerability": "VCID-vc1v-xsbc-kff1" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-xa5e-bbcv-byg9" }, { "vulnerability": "VCID-xksv-mub7-dyck" }, { "vulnerability": "VCID-xpjk-k6tj-2uba" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-yaa8-vy4x-cqbq" }, { "vulnerability": "VCID-ykg2-qbyr-ayd5" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" }, { "vulnerability": "VCID-zf51-58kf-43bf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.0.9" }, { "url": "http://public2.vulnerablecode.io/api/packages/5912?format=api", "purl": "pkg:pypi/plone@4.0.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-31m2-mwzq-judc" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3uw2-j3r6-77ch" }, { "vulnerability": "VCID-3v6x-b2g3-fyhq" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-46az-51p2-yfdf" }, { "vulnerability": "VCID-4bjr-mjug-gqd2" }, { "vulnerability": "VCID-4hzn-mj8g-37ew" }, { "vulnerability": "VCID-4xdg-1sku-17cd" }, { "vulnerability": "VCID-4ym2-39bg-dbga" }, { "vulnerability": "VCID-5bnw-ktd3-8qeb" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-6rsz-krhe-q3gz" }, { "vulnerability": "VCID-7mc8-x346-eyaq" }, { "vulnerability": "VCID-83xg-a5v4-4bcw" }, { "vulnerability": "VCID-8gk5-28z6-7bcf" }, { "vulnerability": "VCID-8j8e-z731-7fbz" }, { "vulnerability": "VCID-8md9-zymx-w7cn" }, { "vulnerability": "VCID-8r52-vc7e-f3bc" }, { "vulnerability": "VCID-99bf-ybqh-dfad" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-a628-5uyk-w3ca" }, { "vulnerability": "VCID-a67e-svcb-ekhc" }, { "vulnerability": "VCID-bj9p-4wzt-47cf" }, { "vulnerability": "VCID-ch1t-qmtc-xqfx" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fd6y-2fcd-jbck" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-hzgj-wca9-z3d1" }, { "vulnerability": "VCID-jhc2-yux7-vybj" }, { "vulnerability": "VCID-k34d-p9vb-g7by" }, { "vulnerability": "VCID-kak6-5sps-z3da" }, { "vulnerability": "VCID-kmd1-vu9u-d7g4" }, { "vulnerability": "VCID-kvvr-zc1s-akhn" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-mgpa-1taj-pycj" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pncb-4m8u-hbaw" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-qkv2-qpe2-97cx" }, { "vulnerability": "VCID-qskf-bt81-5bbe" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-rn4s-px1y-7fbc" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-scgs-bz44-ebfk" }, { "vulnerability": "VCID-swq8-17qu-vyfw" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-u1hz-5a2a-ybac" }, { "vulnerability": "VCID-uduq-ujbb-6qd2" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-uv7n-awe5-2fav" }, { "vulnerability": "VCID-vc1v-xsbc-kff1" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-xa5e-bbcv-byg9" }, { "vulnerability": "VCID-xksv-mub7-dyck" }, { "vulnerability": "VCID-xpjk-k6tj-2uba" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-yaa8-vy4x-cqbq" }, { "vulnerability": "VCID-ykg2-qbyr-ayd5" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" }, { "vulnerability": "VCID-zf51-58kf-43bf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.0.10" }, { "url": "http://public2.vulnerablecode.io/api/packages/6914?format=api", "purl": "pkg:pypi/plone@4.1.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3uw2-j3r6-77ch" }, { "vulnerability": "VCID-3v6x-b2g3-fyhq" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-46az-51p2-yfdf" }, { "vulnerability": "VCID-4bjr-mjug-gqd2" }, { "vulnerability": "VCID-4hzn-mj8g-37ew" }, { "vulnerability": "VCID-4ym2-39bg-dbga" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-6rsz-krhe-q3gz" }, { "vulnerability": "VCID-8gk5-28z6-7bcf" }, { "vulnerability": "VCID-8j8e-z731-7fbz" }, { "vulnerability": "VCID-8md9-zymx-w7cn" }, { "vulnerability": "VCID-99bf-ybqh-dfad" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-a67e-svcb-ekhc" }, { "vulnerability": "VCID-ch1t-qmtc-xqfx" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-hzgj-wca9-z3d1" }, { "vulnerability": "VCID-jhc2-yux7-vybj" }, { "vulnerability": "VCID-k34d-p9vb-g7by" }, { "vulnerability": "VCID-kak6-5sps-z3da" }, { "vulnerability": "VCID-kvvr-zc1s-akhn" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-mgpa-1taj-pycj" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pn5z-xdcd-zqd5" }, { "vulnerability": "VCID-pncb-4m8u-hbaw" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-scgs-bz44-ebfk" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-u1hz-5a2a-ybac" }, { "vulnerability": "VCID-uduq-ujbb-6qd2" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-vc1v-xsbc-kff1" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-xa5e-bbcv-byg9" }, { "vulnerability": "VCID-xksv-mub7-dyck" }, { "vulnerability": "VCID-xpjk-k6tj-2uba" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-yaa8-vy4x-cqbq" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.1.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/6915?format=api", "purl": "pkg:pypi/plone@4.2a1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3uw2-j3r6-77ch" }, { "vulnerability": "VCID-3v6x-b2g3-fyhq" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-46az-51p2-yfdf" }, { "vulnerability": "VCID-4hzn-mj8g-37ew" }, { "vulnerability": "VCID-4ym2-39bg-dbga" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-6rsz-krhe-q3gz" }, { "vulnerability": "VCID-8gk5-28z6-7bcf" }, { "vulnerability": "VCID-8j8e-z731-7fbz" }, { "vulnerability": "VCID-8md9-zymx-w7cn" }, { "vulnerability": "VCID-99bf-ybqh-dfad" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-a67e-svcb-ekhc" }, { "vulnerability": "VCID-ch1t-qmtc-xqfx" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-hzgj-wca9-z3d1" }, { "vulnerability": "VCID-jhc2-yux7-vybj" }, { "vulnerability": "VCID-k34d-p9vb-g7by" }, { "vulnerability": "VCID-kak6-5sps-z3da" }, { "vulnerability": "VCID-kvvr-zc1s-akhn" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-mgpa-1taj-pycj" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pncb-4m8u-hbaw" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-rv8k-q8hx-7yeb" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-scgs-bz44-ebfk" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-u1hz-5a2a-ybac" }, { "vulnerability": "VCID-uduq-ujbb-6qd2" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-vc1v-xsbc-kff1" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-xa5e-bbcv-byg9" }, { "vulnerability": "VCID-xksv-mub7-dyck" }, { "vulnerability": "VCID-xpjk-k6tj-2uba" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.2a1" }, { "url": "http://public2.vulnerablecode.io/api/packages/6922?format=api", "purl": "pkg:pypi/plone@4.3a1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3uw2-j3r6-77ch" }, { "vulnerability": "VCID-3v6x-b2g3-fyhq" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-46az-51p2-yfdf" }, { "vulnerability": "VCID-4hzn-mj8g-37ew" }, { "vulnerability": "VCID-4ym2-39bg-dbga" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-6rsz-krhe-q3gz" }, { "vulnerability": "VCID-8gk5-28z6-7bcf" }, { "vulnerability": "VCID-8j8e-z731-7fbz" }, { "vulnerability": "VCID-8md9-zymx-w7cn" }, { "vulnerability": "VCID-99bf-ybqh-dfad" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-a67e-svcb-ekhc" }, { "vulnerability": "VCID-ch1t-qmtc-xqfx" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-hzgj-wca9-z3d1" }, { "vulnerability": "VCID-jhc2-yux7-vybj" }, { "vulnerability": "VCID-k34d-p9vb-g7by" }, { "vulnerability": "VCID-kak6-5sps-z3da" }, { "vulnerability": "VCID-kvvr-zc1s-akhn" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-mgpa-1taj-pycj" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pncb-4m8u-hbaw" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-scgs-bz44-ebfk" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-u1hz-5a2a-ybac" }, { "vulnerability": "VCID-uduq-ujbb-6qd2" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-vc1v-xsbc-kff1" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-xa5e-bbcv-byg9" }, { "vulnerability": "VCID-xksv-mub7-dyck" }, { "vulnerability": "VCID-xpjk-k6tj-2uba" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3a1" }, { "url": "http://public2.vulnerablecode.io/api/packages/6676?format=api", "purl": "pkg:pypi/plone@4.3.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-4bjr-mjug-gqd2" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-a67e-svcb-ekhc" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pn5z-xdcd-zqd5" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-xa5e-bbcv-byg9" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-yaa8-vy4x-cqbq" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/6927?format=api", "purl": "pkg:pypi/plone@4.3.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-4bjr-mjug-gqd2" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-yaa8-vy4x-cqbq" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.3" } ], "aliases": [ "CVE-2013-7062", "GHSA-4793-w44w-m7xm", "PYSEC-2020-218" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pn5z-xdcd-zqd5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7241?format=api", "vulnerability_id": "VCID-xa5e-bbcv-byg9", "summary": "Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2013-7060", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00455", "scoring_system": "epss", "scoring_elements": "0.64122", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-7060" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/blob/b08a45bc12b1bd42411f1130a487a7a242349ea0/Products/CMFPlone/FactoryTool.py#L272-L274", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/blob/b08a45bc12b1bd42411f1130a487a7a242349ea0/Products/CMFPlone/FactoryTool.py#L272-L274" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-65.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-65.yaml" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/products-cmfplone/PYSEC-2014-67.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/products-cmfplone/PYSEC-2014-67.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7060", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7060" }, { "reference_url": "https://plone.org/security/20131210/path-leak", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/20131210/path-leak" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2013/12/10/15", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2013/12/10/15" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2013/12/12/3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2013/12/12/3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/6927?format=api", "purl": "pkg:pypi/plone@4.3.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-311f-xecp-47fm" }, { "vulnerability": "VCID-36rb-6jkw-j7d8" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-43m1-jkv8-jygp" }, { "vulnerability": "VCID-4bjr-mjug-gqd2" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5kaj-zugj-mbh1" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-6898-z4k5-h3b6" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-m91w-vguw-qkem" }, { "vulnerability": "VCID-njnv-5cwt-4ygy" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-sg6k-wdwq-9bgd" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-ugq4-1vzc-6uh5" }, { "vulnerability": "VCID-w2u3-bnqq-mqfz" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-y2bq-cb4v-mke6" }, { "vulnerability": "VCID-yaa8-vy4x-cqbq" }, { "vulnerability": "VCID-ymbd-m6tf-5bap" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.3" } ], "aliases": [ "CVE-2013-7060", "GHSA-rg52-j87w-pf83", "PYSEC-2014-65", "PYSEC-2014-67" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xa5e-bbcv-byg9" } ], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.3" }