Search for packages
| purl | pkg:pypi/plone@5.1b2 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2021-32633
Aliases: GHSA-5pr9-v234-jw36 |
Path Traversal Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web … |
Vulnerable |
|
PYSEC-2021-889
Aliases: CVE-2021-29002 GHSA-38g6-x6jv-jwff |
A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter. | There are no reported fixed by versions. |
|
PYSEC-2021-84
Aliases: CVE-2021-33512 GHSA-hm2h-f456-6j88 |
Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. |
Vulnerable |
|
PYSEC-2021-85
Aliases: CVE-2021-33513 GHSA-fj67-w3m4-rfmp |
Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. |
Vulnerable |
|
PYSEC-2020-247
Aliases: CVE-2020-28735 GHSA-x7wf-5mjc-6x76 PYSEC-2026-2881 PYSEC-2026-2884 PYSEC-2026-2887 PYSEC-2026-737 |
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). |
Vulnerable |
|
PYSEC-2021-83
Aliases: CVE-2021-33511 GHSA-gc9g-67cq-p7v4 |
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, … |
Vulnerable |
|
PYSEC-2021-79
Aliases: CVE-2021-33507 GHSA-35rg-466w-77h3 PYSEC-2026-2961 PYSEC-2026-2967 |
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS. |
Vulnerable |
|
PYSEC-2021-82
Aliases: CVE-2021-33510 GHSA-4mg4-wvmx-5332 |
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line … |
Vulnerable |
|
PYSEC-2021-81
Aliases: CVE-2021-33509 GHSA-hm2p-fhwx-9285 |
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in … |
Vulnerable |
|
PYSEC-2018-73
Aliases: CVE-2017-1000484 GHSA-xvwv-6wvx-px9x |
By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own … |
Vulnerable |
|
PYSEC-2020-90
Aliases: CVE-2020-7941 GHSA-w6g9-xccc-347h PYSEC-2026-459 |
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing … |
Vulnerable |
|
PYSEC-2020-248
Aliases: CVE-2020-28736 GHSA-2c8c-84w2-j38j PYSEC-2026-2879 PYSEC-2026-2882 PYSEC-2026-2885 PYSEC-2026-735 |
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only … |
Vulnerable |
|
PYSEC-2020-246
Aliases: CVE-2020-28734 GHSA-wq6x-g685-w5f2 PYSEC-2026-2880 PYSEC-2026-2883 PYSEC-2026-2886 PYSEC-2026-736 |
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. |
Vulnerable |
|
PYSEC-2021-80
Aliases: CVE-2021-33508 GHSA-rmpv-rcp6-v8wc |
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a … |
Vulnerable |
|
PYSEC-2023-289
Aliases: CVE-2021-33926 GHSA-47p5-p3jw-w78w |
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, … |
Vulnerable |
|
GHSA-5xfx-55x4-j223
Aliases: CVE-2024-0669 |
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious … |
Vulnerable |
|
GHSA-gc9g-67cq-p7v4
Aliases: CVE-2021-33511 |
Server-Side Request Forgery in Plone Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW … | There are no reported fixed by versions. |
|
GHSA-rmpv-rcp6-v8wc
Aliases: CVE-2021-33508 |
Cross-site scripting in Plone Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the … | There are no reported fixed by versions. |
|
GHSA-fj67-w3m4-rfmp
Aliases: CVE-2021-33513 |
Cross-site scripting in Plone Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. | There are no reported fixed by versions. |
|
GHSA-35rg-466w-77h3
Aliases: CVE-2021-33507 |
Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 … | There are no reported fixed by versions. |
|
GHSA-4mg4-wvmx-5332
Aliases: CVE-2021-33510 |
Server-Side Request Forgery in Plone Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical … | There are no reported fixed by versions. |
|
GHSA-hm2h-f456-6j88
Aliases: CVE-2021-33512 |
Cross-site scripting in Plone Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML … | There are no reported fixed by versions. |
|
GHSA-qfhw-fv3g-v836
Aliases: CVE-2021-35959 |
Plone has stored XSS in folder contents In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder … | There are no reported fixed by versions. |
|
GHSA-cw58-gpgw-hwx2
Aliases: CVE-2020-7940 |
Plone allows weak passwords Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set … |
Vulnerable |
|
GHSA-82j9-wfcf-9v2h
Aliases: CVE-2020-7936 |
Plone Open Redirect Vulnerability An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 … |
Vulnerable |
|
GHSA-8mc4-2xrc-g582
Aliases: CVE-2020-7937 |
Plone cross site scripting (XSS) An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with … | There are no reported fixed by versions. |
|
GHSA-hhmf-7rgg-gcw5
Aliases: CVE-2020-7939 |
Plone SQL Injection Vulnerability SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to … | There are no reported fixed by versions. |
|
PYSEC-2018-71
Aliases: CVE-2017-1000482 GHSA-859j-668v-mrr6 PYSEC-2026-2962 |
A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this … |
Vulnerable Vulnerable |
|
PYSEC-2020-88
Aliases: CVE-2020-7939 GHSA-hhmf-7rgg-gcw5 |
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. … |
Vulnerable |
|
PYSEC-2020-85
Aliases: CVE-2020-7936 GHSA-82j9-wfcf-9v2h |
An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to … |
Vulnerable |
|
PYSEC-2020-86
Aliases: CVE-2020-7937 GHSA-8mc4-2xrc-g582 |
An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to … |
Vulnerable |
|
PYSEC-2021-78
Aliases: CVE-2021-3313 GHSA-hprr-4vfq-fcxw |
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file … |
Vulnerable |
|
PYSEC-2018-70
Aliases: CVE-2017-1000481 GHSA-8g72-gq68-6gqh PYSEC-2026-2963 |
When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a … |
Vulnerable Vulnerable |
|
PYSEC-2018-72
Aliases: CVE-2017-1000483 GHSA-qc57-h2f7-p4hx |
Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the … |
Vulnerable Vulnerable |
|
PYSEC-2021-110
Aliases: CVE-2021-35959 GHSA-qfhw-fv3g-v836 |
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created … |
Vulnerable |
|
PYSEC-2020-89
Aliases: CVE-2020-7940 GHSA-cw58-gpgw-hwx2 |
Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to … |
Vulnerable |
|
PYSEC-2026-733
Aliases: CVE-2006-1711 GHSA-jcwh-rj6j-vm75 |
Plone allows remote users to modify arbitrary portraits Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) … | There are no reported fixed by versions. |
|
PYSEC-2026-1798
Aliases: CVE-2024-22889 GHSA-xg5p-8wg5-rhxm |
Phone information disclosure vulnerability Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all … | There are no reported fixed by versions. |
|
PYSEC-2026-1797
Aliases: CVE-2024-0669 GHSA-5xfx-55x4-j223 |
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious … |
Vulnerable |
|
GHSA-xvwv-6wvx-px9x
Aliases: CVE-2017-1000484 |
Plone Open Redirect By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you … |
Vulnerable Vulnerable |
|
GHSA-8g72-gq68-6gqh
Aliases: CVE-2017-1000481 |
Products.CMFPlone Open Redirect Vulnerability When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the … |
Vulnerable Vulnerable |
|
GHSA-qc57-h2f7-p4hx
Aliases: CVE-2017-1000483 |
Plone Unauthorized Access Vulnerability Accessing private content via `str.format` in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an … |
Vulnerable Vulnerable |
|
GHSA-859j-668v-mrr6
Aliases: CVE-2017-1000482 |
Products.CMFPlone XSS in profile home_page property A member of the Plone site could set javascript in the `home_page` property of … |
Vulnerable Vulnerable |
|
GHSA-w6g9-xccc-347h
Aliases: CVE-2020-7941 |
Plone Unauthenticated Write Vulnerability A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) … | There are no reported fixed by versions. |