Search for packages
| purl | pkg:composer/silverstripe/framework@3.4.3-rc1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-rhx4-hvx9-j387
Aliases: CVE-2025-30148 |
Silverstripe Framework has a XSS vulnerability in HTML editor ### Impact A bad actor with access to edit content in … |
Vulnerable |
|
GHSA-74j9-xhqr-6qv3
|
Reflected Cross Site Scripting (XSS) in error message If a website has been set to the "dev" environment mode, a … |
Vulnerable |
|
GHSA-7cmp-cgg8-4c82
Aliases: CVE-2024-47605 |
Silverstripe Framework has a XSS via insert media remote file oembed ### Impact When using the "insert media" functionality, the … |
Vulnerable |
|
GHSA-mqf3-qpc3-g26q
|
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message > [!IMPORTANT] > This vulnerability only affects sites … |
Vulnerable |
|
GHSA-ff6q-3c9c-6cf5
Aliases: CVE-2024-53277 |
Silverstripe Framework has a XSS in form messages In some cases, form messages can contain HTML markup. This is an … |
Vulnerable |
|
GHSA-32m2-9f76-4gv8
Aliases: CVE-2022-0227 |
Business Logic Errors in SilverStripe Framework SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors. |
Vulnerable |
|
GHSA-rfvw-5848-gxc5
Aliases: CVE-2019-12205 |
Silverstripe Flash Clipboard Reflected XSS SilverStripe versions 3.0.0 until 4.3.5 and 4.4.4 are vulnerable to Flash Clipboard Reflected XSS. Versions … |
Vulnerable |
|
GHSA-2pw2-qpcp-m47x
Aliases: CVE-2020-9311 |
Silverstripe CMS XSS Vulnerability In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can … |
Vulnerable |
|
GHSA-q9ff-3q93-fm8m
Aliases: CVE-2019-19326 |
SilverStripe Web Cache Poisoning through HTTPRequestBuilder SilverStripe through 4.4.4 allows Web Cache Poisoning through HTTPRequestBuilder. |
Vulnerable |
|
GHSA-5fr8-xhqq-4p3q
Aliases: CVE-2019-12246 |
SilverStripe Denial of Service on flush and development URL tools SilverStripe before 4.4.0 allows a Denial of Service on flush … | There are no reported fixed by versions. |
|
GHSA-7mv4-4xpg-xq44
Aliases: CVE-2020-26138 |
FormField with square brackets in field name skips validation FileField with array notation skips validation The FileField class is commonly … |
Vulnerable |
|
GHSA-jvx5-rm6q-gx7p
Aliases: CVE-2019-12245 |
Lack of access control on upoaded files SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). … |
Vulnerable |
|
GHSA-hhvj-mcrx-3vcf
|
silverstripe/framework has Cross-site Scripting vulnerability in page name silverstripe/framework is vulnerable to XSS in Page name where the payload `"><svg/onload=alert(/xss/)>` … |
Vulnerable |
|
GHSA-g84q-cq55-xwgp
|
silverstripe/framework member disclosure in login form There is a user ID enumeration vulnerability in our brute force error messages. - … |
Vulnerable |
|
GHSA-c4c3-j73v-634r
|
silverstripe/framework has Cross-site Scripting vulnerability in page history comparison Authenticated user with page edit permission can craft HTML, which when … |
Vulnerable |
|
GHSA-pp7q-6j3f-74vj
|
silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage RedirectorPage will allow users to specify a non-url malicious script as the redirection … |
Vulnerable |
|
GHSA-chx7-9x8h-r5mg
Aliases: CVE-2024-32981 |
Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload ### Impact A bad actor with access to edit content … |
Vulnerable |
|
GHSA-52cw-pvq9-9m5v
|
Silverstripe uses TinyMCE which allows svg files linked in object tags ### Impact TinyMCE v6 has a configuration value `convert_unsafe_embeds` … |
Vulnerable |
|
GHSA-qm2j-qvq3-j29v
Aliases: CVE-2023-48714 |
Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter ### Impact If a user should not be … |
Vulnerable |
|
GHSA-fw84-xgm8-9jmv
Aliases: CVE-2023-22729 |
Open redirect vulnerability on CMSSecurity relogin screen An attacker can display a link to a third party website on a … |
Vulnerable |
|
GHSA-jh3w-6jp2-vqqm
Aliases: CVE-2023-22728 |
Missing permission check of canView in GridFieldPrintButton The GridField print view incorrectly validates the permission of DataObjects potentially allowing a … |
Vulnerable |
|
GHSA-36xx-7vf6-7mv3
Aliases: CVE-2023-32302 |
Silverstripe Framework: Members with no password can be created and bypass custom login forms When a new `Member` record was … |
Vulnerable |
|
CVE-2020-26138
|
Improper Input Validation In SilverStripe, a FormField with square brackets in the field name skips validation. |
Vulnerable |
|
CVE-2019-12203
|
Session Fixation SilverStripe allows session fixation in the "change password" form. |
Vulnerable |
|
CVE-2019-12617
|
Improper Privilege Management In SilverStripe, there is access escalation for CMS users with limited access through permission cache pollution. |
Vulnerable |
|
CVE-2019-12246
|
Uncontrolled Resource Consumption SilverStripe allows a Denial of Service on flush and development URL tools. |
Vulnerable |
|
CVE-2022-37421
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Silverstripe silverstripe/cms through 4.11.0 allows XSS. |
Vulnerable |
|
CVE-2019-12245
|
Information Exposure SilverStripe has incorrect access control for protected files uploaded via `Upload::loadIntoFile()`. An attacker may be able to guess … |
Vulnerable |
|
CVE-2020-25817
|
Improper Restriction of XML External Entity Reference SilverStripe has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing … |
Vulnerable |
|
CVE-2019-14273
|
Files or Directories Accessible to External Parties In SilverStripe, there is broken access control on files. |
Vulnerable |
|
CVE-2021-36150
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') SilverStripe Framework allows XSS. |
Vulnerable |
|
CVE-2017-18049
|
Injection Vulnerability In the CSV export feature of SilverStripe, it is possible for the output to contain macros and scripts, … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-12205
|
Cross-site Scripting SilverStripe has Flash Clipboard Reflected XSS. |
Vulnerable |
|
CVE-2021-41559
Aliases: GHSA-9fmg-89fx-r33w |
Quadratic blowup in Convert::xml2array() Silverstripe silverstripe/framework has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted … |
Vulnerable |
|
CVE-2017-14498
|
Cross-site Scripting SilverStripe CMS has an XSS via an SVG document that is mishandled by (1) the Insert Media option … |
Vulnerable |
|
CVE-2019-14272
|
Cross-site Scripting In SilverStripe asset-admin, there is XSS in file titles managed through the CMS. |
Vulnerable |
|
SS-2016-011
|
ChangePasswordForm doesn't check Member::canLogIn() After performing a password reset, `ChangePasswordForm::doChangePassword()` logs in the user without checking `Member::canLogIn()`. This presents an … |
Vulnerable Vulnerable |
|
CVE-2017-5197
|
Cross-site Scripting There is an XSS in SilverStripe CMS. |
Vulnerable Vulnerable |
|
CVE-2017-12849
|
Information Exposure Response discrepancy in the login and password reset forms in SilverStripe CMS allows remote attackers to enumerate users … |
Vulnerable Vulnerable |
|
CVE-2019-12437
|
Cross-Site Request Forgery (CSRF) SilverStripe is vulnerable to CSRF in GraphQL mutations |
Vulnerable |
|
CVE-2021-28661
|
Incorrect Authorization Default SilverStripe GraphQL Server (aka silverstripe/graphql) permission checker is not inherited by query subclass. |
Vulnerable |
|
SS-2017-001
|
XSS In page name SilverStripe is vulnerable to XSS via the page name. For instance, page name `"><svg/onload=alert(/xss/)>` will trigger … |
Vulnerable Vulnerable |
|
CVE-2020-26136
|
Improper Authentication In SilverStripe, GraphQL does not honour MFA (multi-factor authentication) when using basic authentication. |
Vulnerable |
|
GHSA-wvfw-w3x6-g526
Aliases: CVE-2019-5715 |
Silverstripe Framework SQLi Vulnerability All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 … |
Vulnerable Vulnerable |
|
GHSA-2jvj-mhf2-g99w
Aliases: CVE-2017-18049 |
SilverStripe CSV Excel Macro Injection In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before … |
Vulnerable Vulnerable |
|
CVE-2023-32302
Aliases: GHSA-36xx-7vf6-7mv3 |
Improper Input Validation Silverstripe Framework is the MVC framework that powers Silverstripe CMS. When a new member record is created … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-gvrw-qqp5-jgc5
Aliases: CVE-2026-54720 |
Silverstripe Framework: Possible XSS attack through media embed ### Impact The "Insert media from web" functionality in the CMS is … |
Not vulnerable |