Search for packages
| purl | pkg:pypi/plone@5.2.5 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-5xfx-55x4-j223
Aliases: CVE-2024-0669 |
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious … |
Vulnerable |
|
PYSEC-2026-733
Aliases: CVE-2006-1711 GHSA-jcwh-rj6j-vm75 |
Plone allows remote users to modify arbitrary portraits Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) … | There are no reported fixed by versions. |
|
PYSEC-2026-1798
Aliases: CVE-2024-22889 GHSA-xg5p-8wg5-rhxm |
Phone information disclosure vulnerability Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all … | There are no reported fixed by versions. |
|
PYSEC-2026-1797
Aliases: CVE-2024-0669 GHSA-5xfx-55x4-j223 |
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2021-32633
|
Path Traversal Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web … |
GHSA-5pr9-v234-jw36
|
|
PYSEC-2021-84
|
Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. |
CVE-2021-33512
GHSA-hm2h-f456-6j88 |
|
PYSEC-2021-85
|
Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. |
CVE-2021-33513
GHSA-fj67-w3m4-rfmp |
|
PYSEC-2021-83
|
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, … |
CVE-2021-33511
GHSA-gc9g-67cq-p7v4 |
|
PYSEC-2021-79
|
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS. |
CVE-2021-33507
GHSA-35rg-466w-77h3 PYSEC-2026-2961 PYSEC-2026-2967 |
|
PYSEC-2021-82
|
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line … |
CVE-2021-33510
GHSA-4mg4-wvmx-5332 |
|
PYSEC-2021-81
|
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in … |
CVE-2021-33509
GHSA-hm2p-fhwx-9285 |
|
PYSEC-2021-80
|
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a … |
CVE-2021-33508
GHSA-rmpv-rcp6-v8wc |
|
PYSEC-2023-289
|
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, … |
CVE-2021-33926
GHSA-47p5-p3jw-w78w |
|
PYSEC-2021-110
|
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created … |
CVE-2021-35959
GHSA-qfhw-fv3g-v836 |