CVE-2022-25238: Improper Neutralization of Input During Web Page Generation

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

PT-2022-11429 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.8.1 through 4.10.9 Description: The issue is related to a quadratic blowup in the Convert::xml2array function, which can be exploited via a crafted XML document to enable a remote attack...

silverstripe framework 授权问题漏洞

silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.10 and earlier versions, which stems from the fact that the Silverstripe ID does not expire upon logout...

silverstripe framework 资源管理错误漏洞

silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.8.1. An attacker can exploit this vulnerability to conduct remote attacks via specially crafted XML documents...

GHSA-GM5X-HPMW-XPXG Silverstripe CMS information disclosure

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to...

Business Logic Errors in SilverStripe Framework

SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors...

PT-2022-13047

Name of the Vulnerable Software and Affected Versions SilverStripe Framework versions prior to 4.10.1 Description The issue is related to business logic errors in the SilverStripe Framework. Recommendations For versions prior to 4.10.1, update to version 4.10.1 or later to resolve the issue...

GHSA-J66H-CC96-C32Q Cross-site Scripting in SilverStripe Framework

SilverStripe Framework through 4.8.1 allows XSS...

CVE-2021-36150

SilverStripe Framework through 4.8.1 allows XSS...

CVE-2021-36150

SilverStripe Framework through 4.8.1 allows XSS...

CVE-2021-36150

SilverStripe Framework through 4.8.1 allows XSS...

CVE-2021-36150

CVE-2021-36150 affects the SilverStripe Framework up to version 4.8.1, which allows Cross-Site Scripting (XSS). The root cause described across connected sources is insufficient validation of input/data, enabling script execution in the context of vulnerable applications. Impact is limited to bro...

CVE-2021-36150: Improper Neutralization of Input During Web Page Generation

SilverStripe Framework through 4.8.1 allows XSS...

PT-2021-21140 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: SilverStripe Framework versions prior to 4.8.2 Description: The issue allows for XSS. Recommendations: For versions prior to 4.8.2, update to version 4.8.2 or later to resolve the issue...

XML External Entitty (XXE)

silverstripe/framework is vulnerable to XML external entity XXE attacks. The loading of external entities and DTDs are not disabled and allows an attacker to perform server-side request forgery SSRF attacks or retrieve confidential system files via a malicious XML document...

CVE-2020-6164

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to...

CVE-2020-6164: Undefined Security Weakness

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to...

PT-2020-18974 · Silverstripe · Silverstripe

Name of the Vulnerable Software and Affected Versions: SilverStripe versions through 4.5.0 Description: A specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a SilverStripe application, without revealing the...

Denial Of Service (DoS)

silverstripe/framework is susceptible to denial of service DoS. The attack exists when an authenticated user with administrative privileges are tricked to open maintenance services in the form of URL Variable Tools such as ?flush, ?isDev and ?isTest or development admin urls /dev/...

Privilege Escalation

silverstripe/framework is vulnerable to privilege escalation. Due to incorrectly shared caches between files and page content, CMS users with different permissions for these object types could gain more access than defined by the system...