VulnerableCode Package Details - pkg:pypi/plone@4.3.4

Vulnerabilities affecting this package (66)

Advisory	Summary	Fixed in package version
CVE-2021-32633 Aliases: GHSA-5pr9-v234-jw36	Path Traversal Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web …	5.2.5 Vulnerable
GMS-2015-51	User information disclosure A vulnerability allows unauthorized disclosure of registered user information.	4.3.8 Vulnerable 5.0.1 Vulnerable
PYSEC-2021-889 Aliases: CVE-2021-29002 GHSA-38g6-x6jv-jwff	A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter.	There are no reported fixed by versions.
PYSEC-2021-84 Aliases: CVE-2021-33512 GHSA-hm2h-f456-6j88	Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.	5.2.5 Vulnerable
PYSEC-2021-85 Aliases: CVE-2021-33513 GHSA-fj67-w3m4-rfmp	Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.	5.2.5 Vulnerable
PYSEC-2020-247 Aliases: CVE-2020-28735 GHSA-x7wf-5mjc-6x76 PYSEC-2026-2881 PYSEC-2026-2884 PYSEC-2026-2887 PYSEC-2026-737	Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).	5.2.3 Vulnerable
PYSEC-2021-83 Aliases: CVE-2021-33511 GHSA-gc9g-67cq-p7v4	Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, …	5.2.5 Vulnerable
PYSEC-2021-79 Aliases: CVE-2021-33507 GHSA-35rg-466w-77h3 PYSEC-2026-2961 PYSEC-2026-2967	Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.	5.2.5 Vulnerable
PYSEC-2017-81 Aliases: CVE-2017-5524 GHSA-p5wr-vp8g-q5p4	Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive …	4.3.12 Vulnerable 5.0.7 Vulnerable
PYSEC-2021-82 Aliases: CVE-2021-33510 GHSA-4mg4-wvmx-5332	Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line …	5.2.5 Vulnerable
PYSEC-2021-81 Aliases: CVE-2021-33509 GHSA-hm2p-fhwx-9285	Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in …	5.2.5 Vulnerable
PYSEC-2018-73 Aliases: CVE-2017-1000484 GHSA-xvwv-6wvx-px9x	By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own …	5.1.0 Vulnerable
PYSEC-2020-90 Aliases: CVE-2020-7941 GHSA-w6g9-xccc-347h PYSEC-2026-459	A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing …	5.2.2 Vulnerable
PYSEC-2020-248 Aliases: CVE-2020-28736 GHSA-2c8c-84w2-j38j PYSEC-2026-2879 PYSEC-2026-2882 PYSEC-2026-2885 PYSEC-2026-735	Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only …	5.2.3 Vulnerable
PYSEC-2020-246 Aliases: CVE-2020-28734 GHSA-wq6x-g685-w5f2 PYSEC-2026-2880 PYSEC-2026-2883 PYSEC-2026-2886 PYSEC-2026-736	Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.	5.2.3 Vulnerable
PYSEC-2021-80 Aliases: CVE-2021-33508 GHSA-rmpv-rcp6-v8wc	Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a …	5.2.5 Vulnerable
PYSEC-2023-289 Aliases: CVE-2021-33926 GHSA-47p5-p3jw-w78w	An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, …	5.2.5 Vulnerable
GHSA-5xfx-55x4-j223 Aliases: CVE-2024-0669	A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious …	6.0.7 Vulnerable
GHSA-gc9g-67cq-p7v4 Aliases: CVE-2021-33511	Server-Side Request Forgery in Plone Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW …	There are no reported fixed by versions.
GHSA-rmpv-rcp6-v8wc Aliases: CVE-2021-33508	Cross-site scripting in Plone Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the …	There are no reported fixed by versions.
GHSA-fj67-w3m4-rfmp Aliases: CVE-2021-33513	Cross-site scripting in Plone Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.	There are no reported fixed by versions.
GHSA-35rg-466w-77h3 Aliases: CVE-2021-33507	Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 …	There are no reported fixed by versions.
GHSA-4mg4-wvmx-5332 Aliases: CVE-2021-33510	Server-Side Request Forgery in Plone Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical …	There are no reported fixed by versions.
GHSA-hm2h-f456-6j88 Aliases: CVE-2021-33512	Cross-site scripting in Plone Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML …	There are no reported fixed by versions.
GHSA-cw58-gpgw-hwx2 Aliases: CVE-2020-7940	Plone allows weak passwords Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set …	4.3.20 Vulnerable
GHSA-82j9-wfcf-9v2h Aliases: CVE-2020-7936	Plone Open Redirect Vulnerability An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 …	4.3.20 Vulnerable
GHSA-hhmf-7rgg-gcw5 Aliases: CVE-2020-7939	Plone SQL Injection Vulnerability SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to …	There are no reported fixed by versions.
PYSEC-2017-53 Aliases: CVE-2015-7316 GHSA-vf8g-m3vq-6p4p	Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before …	4.0a1 Vulnerable 4.3a1 Vulnerable 4.2a1 Vulnerable 4.1a1 Vulnerable 4.3.7 Vulnerable 5.0rc2 Vulnerable
PYSEC-2017-53 Aliases: CVE-2015-7316 GHSA-vf8g-m3vq-6p4p	Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before …	4.0a1 Vulnerable 4.3a1 Vulnerable 4.2a1 Vulnerable 4.1a1 Vulnerable 4.3.7 Vulnerable 5.0rc2 Vulnerable
PYSEC-2017-60 Aliases: CVE-2016-7137 GHSA-69vh-662j-v988	Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers …	4.0a1 Vulnerable 4.3.12 Vulnerable 5.0.7 Vulnerable
PYSEC-2018-71 Aliases: CVE-2017-1000482 GHSA-859j-668v-mrr6 PYSEC-2026-2962	A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this …	4.3.16 Vulnerable 5.1.0 Vulnerable
PYSEC-2017-56 Aliases: CVE-2016-4042 GHSA-v4vj-49m5-wjhw	Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.	5.1a2 Vulnerable
PYSEC-2017-58 Aliases: CVE-2016-7135 GHSA-m7f9-65wr-pwch	Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files …	4.3.12 Vulnerable 5.0.7 Vulnerable
PYSEC-2017-63 Aliases: CVE-2016-7140 GHSA-chvw-gjxf-f8mc	Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, …	4.0a1 Vulnerable 4.3.12 Vulnerable 5.0.7 Vulnerable
PYSEC-2020-88 Aliases: CVE-2020-7939 GHSA-hhmf-7rgg-gcw5	SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. …	5.2.2 Vulnerable
PYSEC-2020-85 Aliases: CVE-2020-7936 GHSA-82j9-wfcf-9v2h	An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to …	5.2.2 Vulnerable
PYSEC-2017-59 Aliases: CVE-2016-7136 GHSA-22jm-p2vv-j2hc	z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks …	4.3.12 Vulnerable 5.0.7 Vulnerable
PYSEC-2017-51 Aliases: CVE-2015-7293 GHSA-p3qm-44cf-f8qx	Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.	5.0a1 Vulnerable
PYSEC-2021-78 Aliases: CVE-2021-3313 GHSA-hprr-4vfq-fcxw	Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file …	5.2.4 Vulnerable
PYSEC-2017-64 Aliases: CVE-2016-7147 GHSA-84jm-cpc5-c7g7	Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and …	4.3.12 Vulnerable 5.0.7 Vulnerable
PYSEC-2018-70 Aliases: CVE-2017-1000481 GHSA-8g72-gq68-6gqh PYSEC-2026-2963	When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a …	4.3.16 Vulnerable 5.1.0 Vulnerable
PYSEC-2018-72 Aliases: CVE-2017-1000483 GHSA-qc57-h2f7-p4hx	Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the …	4.3.16 Vulnerable 5.1.0 Vulnerable
PYSEC-2017-61 Aliases: CVE-2016-7138 GHSA-v3hp-f8qr-cf3p	Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x …	4.0a1 Vulnerable 4.3.12 Vulnerable 5.0.7 Vulnerable
PYSEC-2017-55 Aliases: CVE-2016-4041 GHSA-qqgj-22gr-73vx	Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain …	5.1a2 Vulnerable
PYSEC-2020-89 Aliases: CVE-2020-7940 GHSA-cw58-gpgw-hwx2	Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to …	5.2.1 Vulnerable
PYSEC-2017-62 Aliases: CVE-2016-7139 GHSA-pp4c-2692-7f37	Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x …	4.0a1 Vulnerable 4.3.12 Vulnerable 5.0.7 Vulnerable
PYSEC-2017-52 Aliases: CVE-2015-7315 GHSA-984m-rj28-8c6x PYSEC-2026-2964	Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote …	4.0a1 Vulnerable 4.3a1 Vulnerable 4.2a1 Vulnerable 4.1a1 Vulnerable 4.3.7 Vulnerable 5.0rc2 Vulnerable
PYSEC-2026-733 Aliases: CVE-2006-1711 GHSA-jcwh-rj6j-vm75	Plone allows remote users to modify arbitrary portraits Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) …	There are no reported fixed by versions.
PYSEC-2026-1798 Aliases: CVE-2024-22889 GHSA-xg5p-8wg5-rhxm	Phone information disclosure vulnerability Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all …	There are no reported fixed by versions.
PYSEC-2026-1797 Aliases: CVE-2024-0669 GHSA-5xfx-55x4-j223	A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious …	6.0.7 Vulnerable
GHSA-xvwv-6wvx-px9x Aliases: CVE-2017-1000484	Plone Open Redirect By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you …	4.3.16 Vulnerable 4.3.16 Vulnerable
GHSA-v3hp-f8qr-cf3p Aliases: CVE-2016-7138	Plone XSS Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, …	There are no reported fixed by versions.
GHSA-chvw-gjxf-f8mc Aliases: CVE-2016-7140	Plone vulnerable to Cross-site Scripting Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x …	4.3.12 Vulnerable 4.3.12 Vulnerable
GHSA-8g72-gq68-6gqh Aliases: CVE-2017-1000481	Products.CMFPlone Open Redirect Vulnerability When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the …	4.3.16 Vulnerable 4.3.16 Vulnerable
GHSA-qc57-h2f7-p4hx Aliases: CVE-2017-1000483	Plone Unauthorized Access Vulnerability Accessing private content via `str.format` in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an …	4.3.16 Vulnerable 4.3.16 Vulnerable
GHSA-22jm-p2vv-j2hc Aliases: CVE-2016-7136	Plone XSS z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting …	There are no reported fixed by versions.
GHSA-v4vj-49m5-wjhw Aliases: CVE-2016-4042	Plone vulnerable to unauthorized disclosure of site content Plone versions 3.3 before 4.3.10 and 5.x before 5.0.5 allow remote attackers …	4.3.10 Vulnerable 4.3.10 Vulnerable
GHSA-pp4c-2692-7f37 Aliases: CVE-2016-7139	Plone Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, …	4.3.12 Vulnerable 4.3.12 Vulnerable
GHSA-69vh-662j-v988 Aliases: CVE-2016-7137	Plone Open Redirect Vulnerability Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through …	There are no reported fixed by versions.
GHSA-859j-668v-mrr6 Aliases: CVE-2017-1000482	Products.CMFPlone XSS in profile home_page property A member of the Plone site could set javascript in the `home_page` property of …	4.3.16 Vulnerable 4.3.16 Vulnerable
GHSA-qqgj-22gr-73vx Aliases: CVE-2016-4041	Plone vulnerable to privilege escalation in WebDAV Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV …	4.3.10 Vulnerable 4.3.10 Vulnerable
GHSA-p5wr-vp8g-q5p4 Aliases: CVE-2017-5524	Plone Sandbox Escape Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism …	4.3.12 Vulnerable 5.1b1 Vulnerable 4.3.12 Vulnerable 5.1b1 Vulnerable 4.3.12 Vulnerable
GHSA-w6g9-xccc-347h Aliases: CVE-2020-7941	Plone Unauthenticated Write Vulnerability A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) …	There are no reported fixed by versions.
GHSA-84jm-cpc5-c7g7 Aliases: CVE-2016-7147	Plone XSS in Zope ZMI Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI …	4.3.12 Vulnerable 5.0.7 Vulnerable 4.3.12 Vulnerable 5.0.7 Vulnerable 4.3.12 Vulnerable
GHSA-vf8g-m3vq-6p4p Aliases: CVE-2015-7316	Plone Cross-site Scripting Vulnerability Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the …	4.3.7 Vulnerable 4.3.7 Vulnerable 4.3.7 Vulnerable
GHSA-984m-rj28-8c6x Aliases: CVE-2015-7315	Plone unauthorized member addition vulnerability Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0