plown

À propos Plown est un scanner de sécurité pour le CMS Plone. Bien que Plone ait le meilleur bilan de sécurité de tous les CMS majeurs et soit considéré comme très sécurisé, des erreurs de configuration et des mots de passe faibles peuvent permettre des intrusions. Plown a été développé pour...

Plone Docker - Host Header Injection

Plone Docker Official Image 5.2.13 5221 is vulnerable to Host Header Injection due to improper validation of input by the HOST headers. This can lead to Cross-Site Scripting XSS attacks when the malicious Host header value is reflected in the response. id: CVE-2024-23055 info: name: Plone Docker ...

CVE-2024-22889-Plone-v6.0.9

Produit : Plone CMS Version : v6.0.9 Date de découverte : 10.01.2024. Date de signalement : 10.01.2024. Type de vulnérabilité : Contrôle d'accès incorrect. ID CVE : CVE-2024-22889 Description : En raison d'un contrôle d'accès incorrect dans Plone version v6.0.9, des attaquants distants peuvent...

GHSA-8PCW-H6W9-H46G plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length

Impact When creating an Image or File with a very large filename, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.contenttypes. On Plone 6.2, upgrade to plone.app.contenttypes...

EUVD-2026-84980

plone.app.dexterity has a Denial of Service due to excessive title or description length...

plone.app.dexterity has a Denial of Service due to excessive title or description length

Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...

CVE-2026-57576

plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0...

plone.app.event vulnerable to denial of service via iCalendar import

ImpactBy abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. PatchesThe problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

GHSA-R82H-MQW3-FC56 plone.app.event vulnerable to denial of service via iCalendar import

Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. Patches The problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

plone.app.event vulnerable to denial of service via iCalendar import

Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. Patches The problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

CVE-2026-55247

plone.app.event , Plone's event content type, contains multiple issues in its iCalendar import (src/plone/app/event/ical/importer.py) prior to versions 5.2.4 and 6.0.1 . The importer accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported ...

plone.app.textfield: Stored XSS by spoofing mime type

ImpactA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

PYSEC-2026-3497 plone.app.textfield: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

PT-2026-64105

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

Plone 3.3.x < 4.3.3 Multiple Vulnerabilities (HF 20131210)

The version of Plone installed on the remote host is 3.3.x and prior to 4.3.3. It is, therefore, affected by the following vulnerabilitites: - Products/CMFPlone/FactoryTool.py is initialized in class scope. CVE-2013-7060 - Products/CMFPlone/CatalogTool.py allows remote administrators to bypass...

Plone < 3.3.6 XSS

The version of Plone installed on the remote host is prior to 3.3.6. It is, therefore, affected by a cross-site scripting XSS vulnerability, in PortalTransforms due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by...

Plone 3.3.x < 4.3.12 / 5.0.x < 5.0.7 Multiple Vulnerabilities (HF 20160830)

The version of Plone installed on the remote host is 3.3.x prior to 4.3.12, or 5.0.x 5.0.7. It is, therefore, affected by the following vulnerabilities: - Directory traversal vulnerability in Plone CMS allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in ...

Plone 4.3 < 5.2.7 Reflected XSS and Open Redirect (HF 20220128)

The version of Plone installed on the remote host is 4.3 prior to 5.2.7. It is, therefore, affected by a reflected cross-site scripting XSS and open redirect vulnerability exists in 'Products.ATContentTypes'. An unauthenticated, remote attacker can get a compromised version of the...

Plone @plone/volto 14.0.0-alpha.5 < 15.0.0-alpha.0 Insecure Authentication

The version of the @plone/volto Node.js Package installed on the remote host is later than 14.0.0-alpha.5 prior to 15.0.0-alpha.0. It is, therefore, affected by an insecure authenticaiton vulnerability. A user could have their authentication cookie replaced with an authentication cookie from...

Plone < 4.2.3 Multiple Vulnerabilities (HF 20121106)

The version of Plone installed on the remote host is prior to 4.2.3. It is, therefore, affected by the following vulnerabilities: - registerConfiglet.py in Plone allows remote attackers to execute Python code via unspecified vectors, related to the admin interface. CVE-2012-5485 -...