PYSEC-2021-83

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

Cross site scripting

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...

PYSEC-2021-85

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

Code injection

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

PYSEC-2021-82

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

PYSEC-2021-85

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

PYSEC-2021-81

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

CVE-2021-33507

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...

CVE-2021-33508

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...

CVE-2021-33508

The CVE-2021-33508 entry describes a XSS vulnerability in Plone versions up to 5.2.4 where the user’s full name is mishandled during rendering of the ownership tab, enabling cross-site scripting. Affected product: Plone CMS (up to 5.2.4). Root cause: improper handling of the fullname field in the...

CVE-2021-33509

Plone 5.2.4 and earlier are affected by an arbitrary file-write vulnerability. Remote authenticated managers can cause disk I/O by sending crafted keyword arguments to the ReStructuredText transform in Python scripts, enabling potential file writes to the server. Root cause is exposed via docutil...

CVE-2021-33509

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

CVE-2021-33510

Plone CMS with versions up to 5.2.4 is affected by a server-side request forgery (SSRF) vulnerability allowing remote authenticated managers to fetch an event iCal URL and read one line of a file. The root cause is an SSRF flaw in handling the event iCal URL, leading to data exposure. The provide...

CVE-2021-33510

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

CVE-2021-33511

CVE-2021-33511: Plone (

CVE-2021-33511

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

CVE-2021-33512

Plone up to version 5.2.4 is affected by a stored XSS vulnerability. The issue allows an attacker (Contributor) to upload an SVG or HTML document, enabling stored cross-site scripting in affected content. Root cause is improper handling of file uploads that can inject script into pages. Affected:...

CVE-2021-33512

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

CVE-2021-33513

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

CVE-2021-33513

CVE-2021-33513 affects Plone up to version 5.2.4, where cross-site scripting is possible via the inline_diff methods in Products.CMFDiffTool. The root cause is an XSS flaw in CMFDiffTool’s inline_diff implementation. Public references indicate a specific security fix was released as a Plone hotfi...