Search for packages
| purl | pkg:composer/silverstripe/framework@3.1.20-rc2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-rhx4-hvx9-j387
Aliases: CVE-2025-30148 |
Silverstripe Framework has a XSS vulnerability in HTML editor ### Impact A bad actor with access to edit content in … |
Vulnerable |
|
GHSA-74j9-xhqr-6qv3
|
Reflected Cross Site Scripting (XSS) in error message If a website has been set to the "dev" environment mode, a … |
Vulnerable |
|
GHSA-7cmp-cgg8-4c82
Aliases: CVE-2024-47605 |
Silverstripe Framework has a XSS via insert media remote file oembed ### Impact When using the "insert media" functionality, the … |
Vulnerable |
|
GHSA-mqf3-qpc3-g26q
|
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message > [!IMPORTANT] > This vulnerability only affects sites … |
Vulnerable |
|
GHSA-ff6q-3c9c-6cf5
Aliases: CVE-2024-53277 |
Silverstripe Framework has a XSS in form messages In some cases, form messages can contain HTML markup. This is an … |
Vulnerable |
|
GHSA-32m2-9f76-4gv8
Aliases: CVE-2022-0227 |
Business Logic Errors in SilverStripe Framework SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors. |
Vulnerable |
|
GHSA-rfvw-5848-gxc5
Aliases: CVE-2019-12205 |
Silverstripe Flash Clipboard Reflected XSS SilverStripe versions 3.0.0 until 4.3.5 and 4.4.4 are vulnerable to Flash Clipboard Reflected XSS. Versions … |
Vulnerable |
|
GHSA-2pw2-qpcp-m47x
Aliases: CVE-2020-9311 |
Silverstripe CMS XSS Vulnerability In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can … |
Vulnerable |
|
GHSA-q9ff-3q93-fm8m
Aliases: CVE-2019-19326 |
SilverStripe Web Cache Poisoning through HTTPRequestBuilder SilverStripe through 4.4.4 allows Web Cache Poisoning through HTTPRequestBuilder. |
Vulnerable |
|
GHSA-5fr8-xhqq-4p3q
Aliases: CVE-2019-12246 |
SilverStripe Denial of Service on flush and development URL tools SilverStripe before 4.4.0 allows a Denial of Service on flush … | There are no reported fixed by versions. |
|
GHSA-7mv4-4xpg-xq44
Aliases: CVE-2020-26138 |
FormField with square brackets in field name skips validation FileField with array notation skips validation The FileField class is commonly … |
Vulnerable |
|
GHSA-jvx5-rm6q-gx7p
Aliases: CVE-2019-12245 |
Lack of access control on upoaded files SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). … |
Vulnerable |
|
GHSA-p5h2-vr99-xm99
|
silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()` After performing a password reset, `ChangePasswordForm::doChangePassword()` logs in the user without checking `Member::canLogIn()`. This … |
Vulnerable |
|
GHSA-468j-6jrc-2rjx
|
silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField` List of key / value pairs assigned to `OptionsetField` or `CheckboxSetField` … |
Vulnerable |
|
GHSA-qp29-wcc2-vmpc
|
Silverstripe HtmlEditor embed url sanitisation "Add from URL" doesn't clearly sanitise URL server side HtmlEditorField_Toolbar has an action HtmlEditorField_Toolbar#viewfile, which … |
Vulnerable |
|
GHSA-r9vp-fp72-xgf7
|
silverstripe/framework's `Member.Name` is not escaped The core template `framework/templates/Includes/GridField_print.ss` uses "Printed by $Member.Name". If the currently logged in members first … |
Vulnerable |
|
GHSA-r85g-7jpv-8xrx
|
silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL In follow up to [SS-2016-001](https://www.silverstripe.org/download/security-releases/ss-2016-001/) there is yet a minor unresolved fix … |
Vulnerable |
|
GHSA-97jm-g33h-f46g
|
silverstripe/framework ReadOnly transformation for formfields exploitable Form fields returning isReadonly() as true are vulnerable to reflected XSS injections. This includes … |
Vulnerable |
|
GHSA-f3wp-xpv2-6vmg
|
silverstripe/framework password encryption salt not updated When a user changes their password, the internal salt used for hashing their password … |
Vulnerable |
|
GHSA-5r8w-66hq-rc39
|
silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled If remember me is on and users log … |
Vulnerable |
|
GHSA-52cx-hpc5-cxwc
|
silverstripe/framework missing ACL on reports The SS_Report, and the reports CMS section only checks `canView()` when listing the reports that … |
Vulnerable |
|
GHSA-chx7-9x8h-r5mg
Aliases: CVE-2024-32981 |
Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload ### Impact A bad actor with access to edit content … |
Vulnerable |
|
GHSA-52cw-pvq9-9m5v
|
Silverstripe uses TinyMCE which allows svg files linked in object tags ### Impact TinyMCE v6 has a configuration value `convert_unsafe_embeds` … |
Vulnerable |
|
GHSA-qm2j-qvq3-j29v
Aliases: CVE-2023-48714 |
Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter ### Impact If a user should not be … |
Vulnerable |
|
GHSA-fw84-xgm8-9jmv
Aliases: CVE-2023-22729 |
Open redirect vulnerability on CMSSecurity relogin screen An attacker can display a link to a third party website on a … |
Vulnerable |
|
GHSA-jh3w-6jp2-vqqm
Aliases: CVE-2023-22728 |
Missing permission check of canView in GridFieldPrintButton The GridField print view incorrectly validates the permission of DataObjects potentially allowing a … |
Vulnerable |
|
GHSA-36xx-7vf6-7mv3
Aliases: CVE-2023-32302 |
Silverstripe Framework: Members with no password can be created and bypass custom login forms When a new `Member` record was … |
Vulnerable |
|
SS-2016-010
|
ReadOnly transformation for formfields exploitable Form fields returning `isReadonly()` as true are vulnerable to reflected XSS injections. This includes `ReadonlyField`, … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-26138
|
Improper Input Validation In SilverStripe, a FormField with square brackets in the field name skips validation. |
Vulnerable |
|
CVE-2019-12203
|
Session Fixation SilverStripe allows session fixation in the "change password" form. |
Vulnerable |
|
CVE-2019-12617
|
Improper Privilege Management In SilverStripe, there is access escalation for CMS users with limited access through permission cache pollution. |
Vulnerable |
|
SS-2016-014
|
Pre-existing alc_enc cookies log users in if remember me is disabled If remember me is on and users log in … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-12246
|
Uncontrolled Resource Consumption SilverStripe allows a Denial of Service on flush and development URL tools. |
Vulnerable |
|
CVE-2022-37421
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Silverstripe silverstripe/cms through 4.11.0 allows XSS. |
Vulnerable |
|
SS-2016-016
|
XSS In CMSSecurity BackURL In follow up to SS-2016-001 there is yet a minor unresolved fix to incorrectly encoded URL. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-12245
|
Information Exposure SilverStripe has incorrect access control for protected files uploaded via `Upload::loadIntoFile()`. An attacker may be able to guess … |
Vulnerable |
|
CVE-2020-25817
|
Improper Restriction of XML External Entity Reference SilverStripe has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing … |
Vulnerable |
|
SS-2016-008
|
Password encryption salt expiry When a user changes their password, the internal salt used for hashing their password is not … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
SS-2015-027
|
Insufficient sanitization in "Add from URL" "Add from URL" does not clearly sanitize URL server side in `HtmlEditorField_Toolbar`. The current … |
Vulnerable |
|
CVE-2019-14273
|
Files or Directories Accessible to External Parties In SilverStripe, there is broken access control on files. |
Vulnerable |
|
CVE-2021-36150
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') SilverStripe Framework allows XSS. |
Vulnerable |
|
CVE-2017-18049
|
Injection Vulnerability In the CSV export feature of SilverStripe, it is possible for the output to contain macros and scripts, … |
Vulnerable Vulnerable Vulnerable |
|
SS-2015-027-1
|
Improper Input Validation `HtmlEditor` improper URL sanitisation. |
Vulnerable |
|
CVE-2019-12205
|
Cross-site Scripting SilverStripe has Flash Clipboard Reflected XSS. |
Vulnerable |
|
SS-2016-015
|
XSS In OptionsetField and CheckboxSetField List of key / value pairs assigned to `OptionsetField` or `CheckboxSetField` do not have a … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-41559
Aliases: GHSA-9fmg-89fx-r33w |
Quadratic blowup in Convert::xml2array() Silverstripe silverstripe/framework has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted … |
Vulnerable |
|
CVE-2017-14498
|
Cross-site Scripting SilverStripe CMS has an XSS via an SVG document that is mishandled by (1) the Insert Media option … |
Vulnerable |
|
CVE-2019-14272
|
Cross-site Scripting In SilverStripe asset-admin, there is XSS in file titles managed through the CMS. |
Vulnerable |
|
SS-2016-011
|
ChangePasswordForm doesn't check Member::canLogIn() After performing a password reset, `ChangePasswordForm::doChangePassword()` logs in the user without checking `Member::canLogIn()`. This presents an … |
Vulnerable Vulnerable |
|
SS-2016-013
|
Member.Name isn't escaped The core template `framework/templates/Includes/GridField_print.ss` uses "Printed by $Member.Name". If the currently logged in members first name or … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-5197
|
Cross-site Scripting There is an XSS in SilverStripe CMS. |
Vulnerable Vulnerable |
|
CVE-2017-12849
|
Information Exposure Response discrepancy in the login and password reset forms in SilverStripe CMS allows remote attackers to enumerate users … |
Vulnerable Vulnerable |
|
CVE-2019-12437
|
Cross-Site Request Forgery (CSRF) SilverStripe is vulnerable to CSRF in GraphQL mutations |
Vulnerable |
|
SS-2016-012
|
Missing ACL on reports The `SS_Report`, and the reports CMS section only checks `canView()` when listing the reports that can … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-28661
|
Incorrect Authorization Default SilverStripe GraphQL Server (aka silverstripe/graphql) permission checker is not inherited by query subclass. |
Vulnerable |
|
SS-2015-026-1
|
Cross-site Scripting Form field validation message XSS vulnerability. |
Vulnerable |
|
SS-2017-001
|
XSS In page name SilverStripe is vulnerable to XSS via the page name. For instance, page name `"><svg/onload=alert(/xss/)>` will trigger … |
Vulnerable Vulnerable |
|
CVE-2020-26136
|
Improper Authentication In SilverStripe, GraphQL does not honour MFA (multi-factor authentication) when using basic authentication. |
Vulnerable |
|
GHSA-wvfw-w3x6-g526
Aliases: CVE-2019-5715 |
Silverstripe Framework SQLi Vulnerability All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 … |
Vulnerable Vulnerable |
|
GHSA-2jvj-mhf2-g99w
Aliases: CVE-2017-18049 |
SilverStripe CSV Excel Macro Injection In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before … |
Vulnerable Vulnerable |
|
CVE-2023-32302
Aliases: GHSA-36xx-7vf6-7mv3 |
Improper Input Validation Silverstripe Framework is the MVC framework that powers Silverstripe CMS. When a new member record is created … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-gvrw-qqp5-jgc5
Aliases: CVE-2026-54720 |
Silverstripe Framework: Possible XSS attack through media embed ### Impact The "Insert media from web" functionality in the CMS is … |
Not vulnerable |