VulnerableCode Package Details - pkg:composer/silverstripe/framework@4.2.3

Vulnerabilities affecting this package (53)

Advisory	Summary	Fixed in package version
GHSA-rhx4-hvx9-j387 Aliases: CVE-2025-30148	Silverstripe Framework has a XSS vulnerability in HTML editor ### Impact A bad actor with access to edit content in …	5.3.23 Vulnerable
GHSA-256q-hx8w-xcqx	Silverstripe Framework user enumeration via timing attack on login and password reset forms ### Impact User enumeration is possible by …	5.3.23 Vulnerable
GHSA-74j9-xhqr-6qv3	Reflected Cross Site Scripting (XSS) in error message If a website has been set to the "dev" environment mode, a …	5.3.8 Vulnerable
GHSA-7cmp-cgg8-4c82 Aliases: CVE-2024-47605	Silverstripe Framework has a XSS via insert media remote file oembed ### Impact When using the "insert media" functionality, the …	5.3.8 Vulnerable
GHSA-mqf3-qpc3-g26q	Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message > [!IMPORTANT] > This vulnerability only affects sites …	5.3.8 Vulnerable
GHSA-ff6q-3c9c-6cf5 Aliases: CVE-2024-53277	Silverstripe Framework has a XSS in form messages In some cases, form messages can contain HTML markup. This is an …	5.3.8 Vulnerable
GHSA-wc6r-4ggc-79w5 Aliases: CVE-2022-37429 GMS-2022-6859	Stored XSS using HTMLEditor A malicious content author could add a JavaScript payload to the href attribute of a link …	4.11.13 Vulnerable
GHSA-9cx2-hj6m-fv58 Aliases: CVE-2022-38724 GMS-2022-6856	Silverstripe XSS in shortcodes A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used …	4.11.13 Vulnerable
GHSA-qw4w-vq8v-2wcv Aliases: CVE-2022-37430 GMS-2022-6857	Stored XSS using uppercase characters in HTMLEditor A malicious content author could add a Javascript payload to the href attribute …	4.11.13 Vulnerable
GHSA-vvxf-r4vm-2vm6 Aliases: CVE-2022-38462 GMS-2022-6858	Reflected XSS in querystring parameters An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting …	4.11.13 Vulnerable
GHSA-rr8h-f97q-8p9c Aliases: CVE-2022-38148	Blind SQL Injection via GridFieldSortableHeader Gridfield state is vulnerable to SQL injections. The vast majority of Gridfields in Silverstripe CMS …	4.10.11 Vulnerable
GHSA-32m2-9f76-4gv8 Aliases: CVE-2022-0227	Business Logic Errors in SilverStripe Framework SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors.	4.10.1 Vulnerable
GHSA-rppc-655v-7j3c Aliases: CVE-2022-28803	Stored XSS in link tags added via XHR in SilverStripe Framework SilverStripe Framework 4.x prior to 4.10.9 is vulnerable to …	4.10.9 Vulnerable
GHSA-9fmg-89fx-r33w Aliases: CVE-2021-41559	Quadratic blowup in Convert::xml2array() Silverstripe silverstripe/framework 4.x until 4.10.9 has a quadratic blowup in Convert::xml2array() that enables a remote attack …	4.10.9 Vulnerable
GHSA-jx34-gqqq-r6gm Aliases: CVE-2022-25238	Stored XSS via HTML fields in SilverStripe Framework SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can …	4.10.9 Vulnerable
GHSA-rfvw-5848-gxc5 Aliases: CVE-2019-12205	Silverstripe Flash Clipboard Reflected XSS SilverStripe versions 3.0.0 until 4.3.5 and 4.4.4 are vulnerable to Flash Clipboard Reflected XSS. Versions …	4.3.5 Vulnerable
GHSA-jgw2-f5mx-rg7h Aliases: CVE-2019-14272	SilverStripe asset-admin Cross-site Scripting (XSS) In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.	4.3.5 Vulnerable
GHSA-592m-4533-rxq9 Aliases: CVE-2020-9280	SilverStripe Folders migrated from 3.x may be unsafe to upload to In SilverStripe through 4.5, files uploaded via Forms to …	4.4.6 Vulnerable
GHSA-q9ff-3q93-fm8m Aliases: CVE-2019-19326	SilverStripe Web Cache Poisoning through HTTPRequestBuilder SilverStripe through 4.4.4 allows Web Cache Poisoning through HTTPRequestBuilder.	4.4.7 Vulnerable
GHSA-3vjc-5x79-m9r8 Aliases: CVE-2020-25817	SilverStripe XXE Vulnerability in CSSContentParser SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing …	4.7.4 Vulnerable
GHSA-gm5x-hpmw-xpxg Aliases: CVE-2020-6164	Silverstripe CMS information disclosure In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can …	4.4.7 Vulnerable
GHSA-5fr8-xhqq-4p3q Aliases: CVE-2019-12246	SilverStripe Denial of Service on flush and development URL tools SilverStripe before 4.4.0 allows a Denial of Service on flush …	4.4.0 Vulnerable
GHSA-7mv4-4xpg-xq44 Aliases: CVE-2020-26138	FormField with square brackets in field name skips validation FileField with array notation skips validation The FileField class is commonly …	4.7.4 Vulnerable
GHSA-xm6j-x342-gwq9 Aliases: CVE-2019-16409	SilverStripe Versioned Files module Unpublished files are exposed publicly In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished …	4.3.5 Vulnerable
GHSA-cg8j-8w52-735v Aliases: CVE-2019-12204	Missing warning can lead to unauthenticated admin access in SilverStripe In SilverStripe through 4.3.3, a missing warning about leaving install.php …	4.3.5 Vulnerable
GHSA-jvx5-rm6q-gx7p Aliases: CVE-2019-12245	Lack of access control on upoaded files SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). …	There are no reported fixed by versions.
GHSA-w7r7-r8r9-vrg2 Aliases: CVE-2019-12203	Session fixation in change password form SilverStripe through 4.3.3 allows session fixation in the "change password" form.	4.3.5 Vulnerable
GHSA-chx7-9x8h-r5mg Aliases: CVE-2024-32981	Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload ### Impact A bad actor with access to edit content …	5.2.16 Vulnerable
GHSA-52cw-pvq9-9m5v	Silverstripe uses TinyMCE which allows svg files linked in object tags ### Impact TinyMCE v6 has a configuration value `convert_unsafe_embeds` …	5.2.16 Vulnerable
GHSA-qm2j-qvq3-j29v Aliases: CVE-2023-48714	Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter ### Impact If a user should not be …	4.13.39 Vulnerable
GHSA-fw84-xgm8-9jmv Aliases: CVE-2023-22729	Open redirect vulnerability on CMSSecurity relogin screen An attacker can display a link to a third party website on a …	4.12.5 Vulnerable
GHSA-jh3w-6jp2-vqqm Aliases: CVE-2023-22728	Missing permission check of canView in GridFieldPrintButton The GridField print view incorrectly validates the permission of DataObjects potentially allowing a …	4.12.5 Vulnerable
GHSA-36xx-7vf6-7mv3 Aliases: CVE-2023-32302	Silverstripe Framework: Members with no password can be created and bypass custom login forms When a new `Member` record was …	4.13.14 Vulnerable
GHSA-qvrv-2x7x-78x2 Aliases: CVE-2019-19325	Reflected XSS in SilverStripe SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form …	4.4.5 Vulnerable
GHSA-43jj-2rwc-2m3f Aliases: CVE-2019-14273	Broken access control on files In SilverStripe assets 4.0, there is broken access control on files.	4.3.5 Vulnerable
CVE-2020-9280	Unrestricted Upload of File with Dangerous Type In SilverStripe, files uploaded via Forms to folders migrated from Silverstripe may be …	4.5.1 Vulnerable
CVE-2020-26138	Improper Input Validation In SilverStripe, a FormField with square brackets in the field name skips validation.	4.6.0 Vulnerable
CVE-2019-12203	Session Fixation SilverStripe allows session fixation in the "change password" form.	4.3.4 Vulnerable
CVE-2019-12617	Improper Privilege Management In SilverStripe, there is access escalation for CMS users with limited access through permission cache pollution.	4.3.4 Vulnerable
CVE-2019-12246	Uncontrolled Resource Consumption SilverStripe allows a Denial of Service on flush and development URL tools.	4.3.4 Vulnerable
CVE-2022-37421	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Silverstripe silverstripe/cms through 4.11.0 allows XSS.	4.11.3 Vulnerable
CVE-2019-12245	Information Exposure SilverStripe has incorrect access control for protected files uploaded via `Upload::loadIntoFile()`. An attacker may be able to guess …	4.3.4 Vulnerable
CVE-2020-25817	Improper Restriction of XML External Entity Reference SilverStripe has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing …	4.6.0 Vulnerable
CVE-2021-36150	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') SilverStripe Framework allows XSS.	4.9.0 Vulnerable
CVE-2019-12205	Cross-site Scripting SilverStripe has Flash Clipboard Reflected XSS.	4.3.4 Vulnerable
CVE-2021-41559 Aliases: GHSA-9fmg-89fx-r33w	Quadratic blowup in Convert::xml2array() Silverstripe silverstripe/framework has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted …	4.10.9 Vulnerable
CVE-2019-12437	Cross-Site Request Forgery (CSRF) SilverStripe is vulnerable to CSRF in GraphQL mutations	4.3.4 Vulnerable
CVE-2019-12204	Improper Privilege Management In SilverStripe, a missing warning about leaving `install.php` in a public webroot can lead to unauthenticated admin …	4.3.4 Vulnerable
CVE-2020-6164	Information Exposure In SilverStripe, a specific URL path configured by default through the silverstripe/framework module can be used to disclose …	4.5.4 Vulnerable
CVE-2020-26136	Improper Authentication In SilverStripe, GraphQL does not honour MFA (multi-factor authentication) when using basic authentication.	4.6.0 Vulnerable
GHSA-wvfw-w3x6-g526 Aliases: CVE-2019-5715	Silverstripe Framework SQLi Vulnerability All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 …	4.2.4 Vulnerable 4.2.4 Vulnerable
CVE-2023-32302 Aliases: GHSA-36xx-7vf6-7mv3	Improper Input Validation Silverstripe Framework is the MVC framework that powers Silverstripe CMS. When a new member record is created …	5.0.13 Vulnerable 4.13.14 Vulnerable 5.0.13 Vulnerable 4.13.14 Vulnerable
GHSA-gvrw-qqp5-jgc5 Aliases: CVE-2026-54720	Silverstripe Framework: Possible XSS attack through media embed ### Impact The "Insert media from web" functionality in the CMS is …	6.2.2 Not vulnerable

Next non-vulnerable version	6.2.2
Latest non-vulnerable version	6.2.2
Risk score	9.8