CVE-2024-42850

CVE-2024-42850 An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. Writeup When changing your password, upon submission of the new password, the password is first sent in a POST request to an endpoint which checks t...

CVE-2024-39031

CVE-2024-39031 : Silverpeas Core の Mes agendas における保存型XSS 情報 説明: Mes Agendas では、ユーザーは新しいイベントを作成してカレンダーに追加できます。また、同じドメイン内の他のユーザー（管理者を含む）をこれらのイベントに招待できます。通常のユーザーは、イベント作成時に “Titre” と “Description” フィールドに XSS...

CVE-2024-42849

CVE-2024-42849 Un problema en Silverpeas v.6.4.2 y versiones anteriores permite a un atacante remoto provocar una denegación de servicio mediante la función de cambio de contraseña. Informe Si se intercepta la solicitud de cambio de contraseña y se suministra una cadena suficientemente larga 1MB...

CVE-2025-46047

CVE-2025-46047 Silverpeas = 6.4.2 사용자 이름 열거 PoC Silverpeas 버전 6.4.1 및 6.4.2의 사용자 이름 열거 취약점을 시연하는 개념 증명 스크립트입니다. 취약점 세부 정보 영향받는 소프트웨어: Silverpeas 영향받는 버전: 6.4.1, 6.4.2 및 잠재적으로 이전 버전 수정된 버전: 6.4.3 취약점 유형: 관찰 가능한 응답 차이를 통한 사용자 이름 열거 CWE-204 공급업체 추적 ID: Silverpeas Bug 14829 요약: 이 취약점은 비밀번호 찾기 기능...

Silverpeas-AuthBypass-CVE-2024-36042

Silverpeas-AuthBypass-CVE-2024-36042 Una prueba de concepto limpia y de nivel profesional en Python3 para CVE-2024-36042 — un bypass de autenticación en Silverpeas 6.3.5 causado por la falta de validación de contraseña en AuthenticationServlet. Resumen Silverpeas AuthenticationServlet acepta una...

CVE-2026-78742

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...

CVE-2026-78738

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...

CVE-2026-78741

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...

EUVD-2026-74260

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...

CVE-2026-78741

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...

EUVD-2026-74259

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...

CVE-2026-78738

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...

EUVD-2026-74261

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...

CVE-2026-78742

Silverpeas Core versions up to and including 6.4.6 are vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction field. The flaw allows an attacker to inject malicious scripts that execute in another user's browser, with changed scope and low impact on both conf...

CVE-2026-78738

Silverpeas Core 6.4.6 is vulnerable to Cross-Site Scripting (XSS) via the Document management file upload feature . An attacker can craft a malicious document file that, when uploaded and processed by the application, injects script executed in the context of other users' browsers. The CVSS 3.1 b...

CVE-2026-78741

Silverpeas Core versions up to 6.4.6 are affected by a Cross-Site Scripting (XSS) vulnerability in the wysiwyg-CKEditor image upload feature. The flaw allows an unauthenticated remote attacker, with user interaction, to inject malicious scripts via the image upload mechanism, resulting in a chang...

CVE-2026-78742

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...

CVE-2026-53698

Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set...

EUVD-2026-36068

Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set...

Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set

Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set...