Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/plone@5.0.0
purl pkg:pypi/plone@5.0.0
Tags Ghost
Next non-vulnerable version 5.2.5
Latest non-vulnerable version 6.0.7
Risk 3.1
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-fga8-ymex-67fw
Aliases:
CVE-2017-1000484
GHSA-xvwv-6wvx-px9x
PYSEC-2018-73
By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)
5.1.0
Affected by 20 other vulnerabilities.
VCID-m91w-vguw-qkem
Aliases:
CVE-2016-7138
GHSA-v3hp-f8qr-cf3p
PYSEC-2017-61
Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
5.0.7
Affected by 27 other vulnerabilities.
VCID-sg6k-wdwq-9bgd
Aliases:
CVE-2016-7136
GHSA-22jm-p2vv-j2hc
PYSEC-2017-59
z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request.
5.0.7
Affected by 27 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-31T00:51:13.566496+00:00 GHSA Importer Affected by VCID-fga8-ymex-67fw https://github.com/advisories/GHSA-xvwv-6wvx-px9x 38.6.0
2026-05-30T20:59:08.763517+00:00 GitLab Importer Affected by VCID-sg6k-wdwq-9bgd https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Plone/CVE-2016-7136.yml 38.6.0
2026-05-30T20:58:48.888218+00:00 GitLab Importer Affected by VCID-m91w-vguw-qkem https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Plone/CVE-2016-7138.yml 38.6.0
2026-05-30T20:54:41.185650+00:00 GitLab Importer Affected by VCID-fga8-ymex-67fw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Plone/CVE-2017-1000484.yml 38.6.0