Search for packages
| purl | pkg:composer/silverstripe/framework@3.7.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-rhx4-hvx9-j387
Aliases: CVE-2025-30148 |
Silverstripe Framework has a XSS vulnerability in HTML editor ### Impact A bad actor with access to edit content in … |
Vulnerable |
|
GHSA-74j9-xhqr-6qv3
|
Reflected Cross Site Scripting (XSS) in error message If a website has been set to the "dev" environment mode, a … |
Vulnerable |
|
GHSA-7cmp-cgg8-4c82
Aliases: CVE-2024-47605 |
Silverstripe Framework has a XSS via insert media remote file oembed ### Impact When using the "insert media" functionality, the … |
Vulnerable |
|
GHSA-mqf3-qpc3-g26q
|
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message > [!IMPORTANT] > This vulnerability only affects sites … |
Vulnerable |
|
GHSA-ff6q-3c9c-6cf5
Aliases: CVE-2024-53277 |
Silverstripe Framework has a XSS in form messages In some cases, form messages can contain HTML markup. This is an … |
Vulnerable |
|
GHSA-32m2-9f76-4gv8
Aliases: CVE-2022-0227 |
Business Logic Errors in SilverStripe Framework SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors. |
Vulnerable |
|
GHSA-rfvw-5848-gxc5
Aliases: CVE-2019-12205 |
Silverstripe Flash Clipboard Reflected XSS SilverStripe versions 3.0.0 until 4.3.5 and 4.4.4 are vulnerable to Flash Clipboard Reflected XSS. Versions … |
Vulnerable |
|
GHSA-7mv4-4xpg-xq44
Aliases: CVE-2020-26138 |
FormField with square brackets in field name skips validation FileField with array notation skips validation The FileField class is commonly … |
Vulnerable |
|
GHSA-chx7-9x8h-r5mg
Aliases: CVE-2024-32981 |
Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload ### Impact A bad actor with access to edit content … |
Vulnerable |
|
GHSA-52cw-pvq9-9m5v
|
Silverstripe uses TinyMCE which allows svg files linked in object tags ### Impact TinyMCE v6 has a configuration value `convert_unsafe_embeds` … |
Vulnerable |
|
GHSA-qm2j-qvq3-j29v
Aliases: CVE-2023-48714 |
Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter ### Impact If a user should not be … |
Vulnerable |
|
GHSA-fw84-xgm8-9jmv
Aliases: CVE-2023-22729 |
Open redirect vulnerability on CMSSecurity relogin screen An attacker can display a link to a third party website on a … |
Vulnerable |
|
GHSA-jh3w-6jp2-vqqm
Aliases: CVE-2023-22728 |
Missing permission check of canView in GridFieldPrintButton The GridField print view incorrectly validates the permission of DataObjects potentially allowing a … |
Vulnerable |
|
GHSA-36xx-7vf6-7mv3
Aliases: CVE-2023-32302 |
Silverstripe Framework: Members with no password can be created and bypass custom login forms When a new `Member` record was … |
Vulnerable |
|
CVE-2020-26138
|
Improper Input Validation In SilverStripe, a FormField with square brackets in the field name skips validation. |
Vulnerable |
|
CVE-2019-12203
|
Session Fixation SilverStripe allows session fixation in the "change password" form. |
Vulnerable |
|
CVE-2019-12617
|
Improper Privilege Management In SilverStripe, there is access escalation for CMS users with limited access through permission cache pollution. |
Vulnerable |
|
CVE-2019-12246
|
Uncontrolled Resource Consumption SilverStripe allows a Denial of Service on flush and development URL tools. |
Vulnerable |
|
CVE-2022-37421
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Silverstripe silverstripe/cms through 4.11.0 allows XSS. |
Vulnerable |
|
CVE-2019-12245
|
Information Exposure SilverStripe has incorrect access control for protected files uploaded via `Upload::loadIntoFile()`. An attacker may be able to guess … |
Vulnerable |
|
CVE-2020-25817
|
Improper Restriction of XML External Entity Reference SilverStripe has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing … |
Vulnerable |
|
CVE-2019-14273
|
Files or Directories Accessible to External Parties In SilverStripe, there is broken access control on files. |
Vulnerable |
|
CVE-2021-36150
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') SilverStripe Framework allows XSS. |
Vulnerable |
|
CVE-2019-12205
|
Cross-site Scripting SilverStripe has Flash Clipboard Reflected XSS. |
Vulnerable |
|
CVE-2021-41559
Aliases: GHSA-9fmg-89fx-r33w |
Quadratic blowup in Convert::xml2array() Silverstripe silverstripe/framework has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted … |
Vulnerable |
|
CVE-2019-14272
|
Cross-site Scripting In SilverStripe asset-admin, there is XSS in file titles managed through the CMS. |
Vulnerable |
|
CVE-2019-12437
|
Cross-Site Request Forgery (CSRF) SilverStripe is vulnerable to CSRF in GraphQL mutations |
Vulnerable |
|
CVE-2020-26136
|
Improper Authentication In SilverStripe, GraphQL does not honour MFA (multi-factor authentication) when using basic authentication. |
Vulnerable |
|
CVE-2023-32302
Aliases: GHSA-36xx-7vf6-7mv3 |
Improper Input Validation Silverstripe Framework is the MVC framework that powers Silverstripe CMS. When a new member record is created … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-gvrw-qqp5-jgc5
Aliases: CVE-2026-54720 |
Silverstripe Framework: Possible XSS attack through media embed ### Impact The "Insert media from web" functionality in the CMS is … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-2pw2-qpcp-m47x
|
Silverstripe CMS XSS Vulnerability In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can … |
CVE-2020-9311
|
|
GHSA-q9ff-3q93-fm8m
|
SilverStripe Web Cache Poisoning through HTTPRequestBuilder SilverStripe through 4.4.4 allows Web Cache Poisoning through HTTPRequestBuilder. |
CVE-2019-19326
|