droopescan

droopescan A plugin-based scanner that aids security researchers in identifying issues with several CMS. Usage of droopescan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume n...

CVE-2026-55779

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

silverstripe/versioned has XSS in archive admin restore

Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin Reporter Steve Boyd Silverstripe Ltd...

EUVD-2026-68015

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

CVE-2026-55779

Silverstripe Versioned (a versioning module for Silverstripe CMS) contains a stored XSS in RestoreAction::getRestoreMessage() (src/RestoreAction.php). The method builds ArchiveAdmin restore notifications rendered as CAST_HTML but inserts $restoredItem->Title, $restoredItem->URLSegment, $res...

CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

PT-2026-83368

Name of the Vulnerable Software and Affected Versions Silverstripe Versioned versions prior to 3.2.1 Description In the RestoreAction::getRestoreMessage function within src/RestoreAction.php, restore notifications in ArchiveAdmin are rendered as CAST HTML. The system fails to apply Convert::raw2x...

CVE-2026-54718

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

CVE-2026-54721

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template

Impact The advanced workflow email template field is vulnerable to a specially crafted payload that can be used to run arbitrary code on the server. Reported by Steve Boyd Silverstripe Ltd...

EUVD-2026-67160

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

CVE-2026-54718

Silverstripe Advanced Workflow (the symbiote/silverstripe-advancedworkflow module) is vulnerable to remote code execution prior to versions 6.4.5, 7.1.3, and 7.2.1. An attacker with permission to author the advanced workflow email template can inject a specially crafted server-side template paylo...

CVE-2026-54718 Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

CVE-2026-54718 Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

silverstripe/userforms vulnerable to remote code execution via userforms email subject

Impact The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server. Reported by Jack Wallace from Bastion Security...

GHSA-G8WR-R2V2-VQC6 silverstripe/userforms vulnerable to remote code execution via userforms email subject

Impact The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server. Reported by Jack Wallace from Bastion Security...

CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

CVE-2026-54721

Silverstripe UserForms (a visual form builder module for Silverstripe CMS) contains a remote code execution vulnerability in the email recipient subject field. Between versions 6.0.0 and the fixed releases, a specially crafted payload in the subject field is interpreted as executable server-side ...