Search for packages
| purl | pkg:composer/silverstripe/framework@4.10.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-rhx4-hvx9-j387
Aliases: CVE-2025-30148 |
Silverstripe Framework has a XSS vulnerability in HTML editor ### Impact A bad actor with access to edit content in … |
Vulnerable |
|
GHSA-256q-hx8w-xcqx
|
Silverstripe Framework user enumeration via timing attack on login and password reset forms ### Impact User enumeration is possible by … |
Vulnerable |
|
GHSA-74j9-xhqr-6qv3
|
Reflected Cross Site Scripting (XSS) in error message If a website has been set to the "dev" environment mode, a … |
Vulnerable |
|
GHSA-7cmp-cgg8-4c82
Aliases: CVE-2024-47605 |
Silverstripe Framework has a XSS via insert media remote file oembed ### Impact When using the "insert media" functionality, the … |
Vulnerable |
|
GHSA-mqf3-qpc3-g26q
|
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message > [!IMPORTANT] > This vulnerability only affects sites … |
Vulnerable |
|
GHSA-ff6q-3c9c-6cf5
Aliases: CVE-2024-53277 |
Silverstripe Framework has a XSS in form messages In some cases, form messages can contain HTML markup. This is an … |
Vulnerable |
|
GHSA-wc6r-4ggc-79w5
Aliases: CVE-2022-37429 GMS-2022-6859 |
Stored XSS using HTMLEditor A malicious content author could add a JavaScript payload to the href attribute of a link … |
Vulnerable |
|
GHSA-9cx2-hj6m-fv58
Aliases: CVE-2022-38724 GMS-2022-6856 |
Silverstripe XSS in shortcodes A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used … |
Vulnerable |
|
GHSA-qw4w-vq8v-2wcv
Aliases: CVE-2022-37430 GMS-2022-6857 |
Stored XSS using uppercase characters in HTMLEditor A malicious content author could add a Javascript payload to the href attribute … |
Vulnerable |
|
GHSA-vvxf-r4vm-2vm6
Aliases: CVE-2022-38462 GMS-2022-6858 |
Reflected XSS in querystring parameters An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting … |
Vulnerable |
|
GHSA-rr8h-f97q-8p9c
Aliases: CVE-2022-38148 |
Blind SQL Injection via GridFieldSortableHeader Gridfield state is vulnerable to SQL injections. The vast majority of Gridfields in Silverstripe CMS … |
Vulnerable |
|
GHSA-rppc-655v-7j3c
Aliases: CVE-2022-28803 |
Stored XSS in link tags added via XHR in SilverStripe Framework SilverStripe Framework 4.x prior to 4.10.9 is vulnerable to … |
Vulnerable |
|
GHSA-9fmg-89fx-r33w
Aliases: CVE-2021-41559 |
Quadratic blowup in Convert::xml2array() Silverstripe silverstripe/framework 4.x until 4.10.9 has a quadratic blowup in Convert::xml2array() that enables a remote attack … |
Vulnerable |
|
GHSA-jx34-gqqq-r6gm
Aliases: CVE-2022-25238 |
Stored XSS via HTML fields in SilverStripe Framework SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can … |
Vulnerable |
|
GHSA-chx7-9x8h-r5mg
Aliases: CVE-2024-32981 |
Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload ### Impact A bad actor with access to edit content … |
Vulnerable |
|
GHSA-52cw-pvq9-9m5v
|
Silverstripe uses TinyMCE which allows svg files linked in object tags ### Impact TinyMCE v6 has a configuration value `convert_unsafe_embeds` … |
Vulnerable |
|
GHSA-qm2j-qvq3-j29v
Aliases: CVE-2023-48714 |
Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter ### Impact If a user should not be … |
Vulnerable |
|
GHSA-fw84-xgm8-9jmv
Aliases: CVE-2023-22729 |
Open redirect vulnerability on CMSSecurity relogin screen An attacker can display a link to a third party website on a … |
Vulnerable |
|
GHSA-jh3w-6jp2-vqqm
Aliases: CVE-2023-22728 |
Missing permission check of canView in GridFieldPrintButton The GridField print view incorrectly validates the permission of DataObjects potentially allowing a … |
Vulnerable |
|
GHSA-36xx-7vf6-7mv3
Aliases: CVE-2023-32302 |
Silverstripe Framework: Members with no password can be created and bypass custom login forms When a new `Member` record was … |
Vulnerable |
|
CVE-2022-37421
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Silverstripe silverstripe/cms through 4.11.0 allows XSS. |
Vulnerable |
|
CVE-2021-41559
Aliases: GHSA-9fmg-89fx-r33w |
Quadratic blowup in Convert::xml2array() Silverstripe silverstripe/framework has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted … |
Vulnerable |
|
CVE-2023-32302
Aliases: GHSA-36xx-7vf6-7mv3 |
Improper Input Validation Silverstripe Framework is the MVC framework that powers Silverstripe CMS. When a new member record is created … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-gvrw-qqp5-jgc5
Aliases: CVE-2026-54720 |
Silverstripe Framework: Possible XSS attack through media embed ### Impact The "Insert media from web" functionality in the CMS is … |
Not vulnerable |