Search for packages
| purl | pkg:composer/silverstripe/framework@4.2.0-beta1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-rhx4-hvx9-j387
Aliases: CVE-2025-30148 |
Silverstripe Framework has a XSS vulnerability in HTML editor ### Impact A bad actor with access to edit content in … |
Vulnerable |
|
GHSA-256q-hx8w-xcqx
|
Silverstripe Framework user enumeration via timing attack on login and password reset forms ### Impact User enumeration is possible by … |
Vulnerable |
|
GHSA-74j9-xhqr-6qv3
|
Reflected Cross Site Scripting (XSS) in error message If a website has been set to the "dev" environment mode, a … |
Vulnerable |
|
GHSA-7cmp-cgg8-4c82
Aliases: CVE-2024-47605 |
Silverstripe Framework has a XSS via insert media remote file oembed ### Impact When using the "insert media" functionality, the … |
Vulnerable |
|
GHSA-mqf3-qpc3-g26q
|
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message > [!IMPORTANT] > This vulnerability only affects sites … |
Vulnerable |
|
GHSA-ff6q-3c9c-6cf5
Aliases: CVE-2024-53277 |
Silverstripe Framework has a XSS in form messages In some cases, form messages can contain HTML markup. This is an … |
Vulnerable |
|
GHSA-wc6r-4ggc-79w5
Aliases: CVE-2022-37429 GMS-2022-6859 |
Stored XSS using HTMLEditor A malicious content author could add a JavaScript payload to the href attribute of a link … |
Vulnerable |
|
GHSA-9cx2-hj6m-fv58
Aliases: CVE-2022-38724 GMS-2022-6856 |
Silverstripe XSS in shortcodes A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used … |
Vulnerable |
|
GHSA-qw4w-vq8v-2wcv
Aliases: CVE-2022-37430 GMS-2022-6857 |
Stored XSS using uppercase characters in HTMLEditor A malicious content author could add a Javascript payload to the href attribute … |
Vulnerable |
|
GHSA-vvxf-r4vm-2vm6
Aliases: CVE-2022-38462 GMS-2022-6858 |
Reflected XSS in querystring parameters An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting … |
Vulnerable |
|
GHSA-rr8h-f97q-8p9c
Aliases: CVE-2022-38148 |
Blind SQL Injection via GridFieldSortableHeader Gridfield state is vulnerable to SQL injections. The vast majority of Gridfields in Silverstripe CMS … |
Vulnerable |
|
GHSA-32m2-9f76-4gv8
Aliases: CVE-2022-0227 |
Business Logic Errors in SilverStripe Framework SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors. |
Vulnerable |
|
GHSA-rppc-655v-7j3c
Aliases: CVE-2022-28803 |
Stored XSS in link tags added via XHR in SilverStripe Framework SilverStripe Framework 4.x prior to 4.10.9 is vulnerable to … |
Vulnerable |
|
GHSA-9fmg-89fx-r33w
Aliases: CVE-2021-41559 |
Quadratic blowup in Convert::xml2array() Silverstripe silverstripe/framework 4.x until 4.10.9 has a quadratic blowup in Convert::xml2array() that enables a remote attack … |
Vulnerable |
|
GHSA-jx34-gqqq-r6gm
Aliases: CVE-2022-25238 |
Stored XSS via HTML fields in SilverStripe Framework SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can … |
Vulnerable |
|
GHSA-rfvw-5848-gxc5
Aliases: CVE-2019-12205 |
Silverstripe Flash Clipboard Reflected XSS SilverStripe versions 3.0.0 until 4.3.5 and 4.4.4 are vulnerable to Flash Clipboard Reflected XSS. Versions … |
Vulnerable |
|
GHSA-jgw2-f5mx-rg7h
Aliases: CVE-2019-14272 |
SilverStripe asset-admin Cross-site Scripting (XSS) In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS. |
Vulnerable |
|
GHSA-592m-4533-rxq9
Aliases: CVE-2020-9280 |
SilverStripe Folders migrated from 3.x may be unsafe to upload to In SilverStripe through 4.5, files uploaded via Forms to … |
Vulnerable |
|
GHSA-q9ff-3q93-fm8m
Aliases: CVE-2019-19326 |
SilverStripe Web Cache Poisoning through HTTPRequestBuilder SilverStripe through 4.4.4 allows Web Cache Poisoning through HTTPRequestBuilder. |
Vulnerable |
|
GHSA-3vjc-5x79-m9r8
Aliases: CVE-2020-25817 |
SilverStripe XXE Vulnerability in CSSContentParser SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing … |
Vulnerable |
|
GHSA-gm5x-hpmw-xpxg
Aliases: CVE-2020-6164 |
Silverstripe CMS information disclosure In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can … |
Vulnerable |
|
GHSA-5fr8-xhqq-4p3q
Aliases: CVE-2019-12246 |
SilverStripe Denial of Service on flush and development URL tools SilverStripe before 4.4.0 allows a Denial of Service on flush … |
Vulnerable |
|
GHSA-7mv4-4xpg-xq44
Aliases: CVE-2020-26138 |
FormField with square brackets in field name skips validation FileField with array notation skips validation The FileField class is commonly … |
Vulnerable |
|
GHSA-xm6j-x342-gwq9
Aliases: CVE-2019-16409 |
SilverStripe Versioned Files module Unpublished files are exposed publicly In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished … |
Vulnerable |
|
GHSA-cg8j-8w52-735v
Aliases: CVE-2019-12204 |
Missing warning can lead to unauthenticated admin access in SilverStripe In SilverStripe through 4.3.3, a missing warning about leaving install.php … |
Vulnerable |
|
GHSA-jvx5-rm6q-gx7p
Aliases: CVE-2019-12245 |
Lack of access control on upoaded files SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). … | There are no reported fixed by versions. |
|
GHSA-w7r7-r8r9-vrg2
Aliases: CVE-2019-12203 |
Session fixation in change password form SilverStripe through 4.3.3 allows session fixation in the "change password" form. |
Vulnerable |
|
GHSA-chx7-9x8h-r5mg
Aliases: CVE-2024-32981 |
Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload ### Impact A bad actor with access to edit content … |
Vulnerable |
|
GHSA-52cw-pvq9-9m5v
|
Silverstripe uses TinyMCE which allows svg files linked in object tags ### Impact TinyMCE v6 has a configuration value `convert_unsafe_embeds` … |
Vulnerable |
|
GHSA-qm2j-qvq3-j29v
Aliases: CVE-2023-48714 |
Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter ### Impact If a user should not be … |
Vulnerable |
|
GHSA-fw84-xgm8-9jmv
Aliases: CVE-2023-22729 |
Open redirect vulnerability on CMSSecurity relogin screen An attacker can display a link to a third party website on a … |
Vulnerable |
|
GHSA-jh3w-6jp2-vqqm
Aliases: CVE-2023-22728 |
Missing permission check of canView in GridFieldPrintButton The GridField print view incorrectly validates the permission of DataObjects potentially allowing a … |
Vulnerable |
|
GHSA-36xx-7vf6-7mv3
Aliases: CVE-2023-32302 |
Silverstripe Framework: Members with no password can be created and bypass custom login forms When a new `Member` record was … |
Vulnerable |
|
GHSA-qvrv-2x7x-78x2
Aliases: CVE-2019-19325 |
Reflected XSS in SilverStripe SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form … |
Vulnerable |
|
GHSA-43jj-2rwc-2m3f
Aliases: CVE-2019-14273 |
Broken access control on files In SilverStripe assets 4.0, there is broken access control on files. |
Vulnerable |
|
CVE-2020-9280
|
Unrestricted Upload of File with Dangerous Type In SilverStripe, files uploaded via Forms to folders migrated from Silverstripe may be … |
Vulnerable |
|
CVE-2020-26138
|
Improper Input Validation In SilverStripe, a FormField with square brackets in the field name skips validation. |
Vulnerable |
|
CVE-2019-12203
|
Session Fixation SilverStripe allows session fixation in the "change password" form. |
Vulnerable |
|
CVE-2019-12617
|
Improper Privilege Management In SilverStripe, there is access escalation for CMS users with limited access through permission cache pollution. |
Vulnerable |
|
CVE-2019-12246
|
Uncontrolled Resource Consumption SilverStripe allows a Denial of Service on flush and development URL tools. |
Vulnerable |
|
CVE-2022-37421
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Silverstripe silverstripe/cms through 4.11.0 allows XSS. |
Vulnerable |
|
CVE-2019-12245
|
Information Exposure SilverStripe has incorrect access control for protected files uploaded via `Upload::loadIntoFile()`. An attacker may be able to guess … |
Vulnerable |
|
CVE-2020-25817
|
Improper Restriction of XML External Entity Reference SilverStripe has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing … |
Vulnerable |
|
CVE-2021-36150
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') SilverStripe Framework allows XSS. |
Vulnerable |
|
CVE-2019-12205
|
Cross-site Scripting SilverStripe has Flash Clipboard Reflected XSS. |
Vulnerable |
|
CVE-2021-41559
Aliases: GHSA-9fmg-89fx-r33w |
Quadratic blowup in Convert::xml2array() Silverstripe silverstripe/framework has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted … |
Vulnerable |
|
CVE-2019-12437
|
Cross-Site Request Forgery (CSRF) SilverStripe is vulnerable to CSRF in GraphQL mutations |
Vulnerable |
|
CVE-2019-12204
|
Improper Privilege Management In SilverStripe, a missing warning about leaving `install.php` in a public webroot can lead to unauthenticated admin … |
Vulnerable |
|
CVE-2020-6164
|
Information Exposure In SilverStripe, a specific URL path configured by default through the silverstripe/framework module can be used to disclose … |
Vulnerable |
|
CVE-2020-26136
|
Improper Authentication In SilverStripe, GraphQL does not honour MFA (multi-factor authentication) when using basic authentication. |
Vulnerable |
|
CVE-2023-32302
Aliases: GHSA-36xx-7vf6-7mv3 |
Improper Input Validation Silverstripe Framework is the MVC framework that powers Silverstripe CMS. When a new member record is created … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-gvrw-qqp5-jgc5
Aliases: CVE-2026-54720 |
Silverstripe Framework: Possible XSS attack through media embed ### Impact The "Insert media from web" functionality in the CMS is … |
Not vulnerable |