Lookup for vulnerable packages by Package URL.
| Purl | pkg:composer/opensource-workshop/connect-cms@2.4.7 |
|---|
| Type | composer |
|---|
| Namespace | opensource-workshop |
|---|
| Name | connect-cms |
|---|
| Version | 2.4.7 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 2.41.1 |
|---|
| Latest_non_vulnerable_version | 2.41.1 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-1pxp-npuh-p3bx |
| vulnerability_id |
VCID-1pxp-npuh-p3bx |
| summary |
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Versions 1.41.1 and 2.41.1 contain a patch. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-32278, GHSA-mv3p-7p89-wq9p
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1pxp-npuh-p3bx |
|
| 1 |
| url |
VCID-5yh8-ck3y-nffp |
| vulnerability_id |
VCID-5yh8-ck3y-nffp |
| summary |
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-32300, GHSA-qr6x-wvxr-8hm9
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5yh8-ck3y-nffp |
|
| 2 |
| url |
VCID-ax7b-4rpg-g3fw |
| vulnerability_id |
VCID-ax7b-4rpg-g3fw |
| summary |
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Versions 1.41.1 and 2.41.1 contain a patch. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-32299, GHSA-62ch-j6x7-722j
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ax7b-4rpg-g3fw |
|
| 3 |
| url |
VCID-rqvq-a22q-5yhy |
| vulnerability_id |
VCID-rqvq-a22q-5yhy |
| summary |
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-32279, GHSA-jh46-85jr-6ph9
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rqvq-a22q-5yhy |
|
| 4 |
| url |
VCID-u3my-rrph-sbcd |
| vulnerability_id |
VCID-u3my-rrph-sbcd |
| summary |
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an authenticated user may be able to execute arbitrary code in the Code Study Plugin. Versions 1.41.1 and 2.41.1 contain a patch. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-32276, GHSA-hxqw-6qv7-cqfv
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u3my-rrph-sbcd |
|
|
|---|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-cafq-qnx1-63gg |
| vulnerability_id |
VCID-cafq-qnx1-63gg |
| summary |
Connect-CMS Access control vulnerability
### Impact（影響）
There is an Access control vulnerability on the management system of Connect-CMS.
Affected Version : Connect-CMS v1.8.6, 2.4.6 and earlier
### Patches（修正バージョン）
version v1.8.7, v2.4.7
### Workarounds（運用回避手段）
Upgrade Connect-CMS to latest version |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-5rjc-jc28-cwgg
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cafq-qnx1-63gg |
|
|
|---|
| Risk_score | 4.0 |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:composer/opensource-workshop/connect-cms@2.4.7 |
|---|