CVE-2026-54721: Improper Control of Generation of Code

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

Cross-site Scripting (XSS)

Silverstripe CMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of page titles when rendered in CMS breadcrumbs, which allows an attacker to inject malicious JavaScript that executes in the browser when the affected page list view is accessed...

CVE-2026-54717

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1...

CVE-2026-54717 Silverstripe: XSS in breadcrumbs in page list view

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1...

CVE-2026-54717 Silverstripe: XSS in breadcrumbs in page list view

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1...

CVE-2026-54717: Improper Neutralization of Input During Web Page Generation

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1...

PT-2026-68756

Name of the Vulnerable Software and Affected Versions Silverstripe CMS versions prior to 6.2.1 Description Page breadcrumbs in the CMS are susceptible to cross-site scripting XSS when accessed via the page list view. This occurs because page titles are rendered into the breadcrumb trail without...

CVE-2021-27938

A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL...

EUVD-2015-5079

Malware in sbrugna...

EUVD-2021-0726

Malware in sbrugna...

EUVD-2022-4928

Malicious code in bioql PyPI...

EUVD-2022-3845

Malicious code in bioql PyPI...

EUVD-2022-5827

Malicious code in bioql PyPI...

EUVD-2024-0378

Malicious code in bioql PyPI...

EUVD-2022-4094

Malicious code in bioql PyPI...

EUVD-2022-4289

Malicious code in bioql PyPI...

EUVD-2022-2030

Malicious code in bioql PyPI...

EUVD-2022-3780

Malicious code in bioql PyPI...

CVE-2023-44401

The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, canView permission checks are bypassed for ORM data in paginated GraphQL query results where the total number of records is greater than the number o...

CVE-2019-19326

Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be vulnerable to web cache poisoning. Through modifying the X-Original-Url and X-HTTP-Method-Override headers, responses with malicious HTTP headers can return...