Plone Docker - Host Header Injection

Plone Docker Official Image 5.2.13 5221 is vulnerable to Host Header Injection due to improper validation of input by the HOST headers. This can lead to Cross-Site Scripting XSS attacks when the malicious Host header value is reflected in the response. id: CVE-2024-23055 info: name: Plone Docker ...

CVE-2024-22889-Plone-v6.0.9

Product: Plone CMS Version: v6.0.9 Date found: 10.01.2024. Date reported: 10.01.2024. Vulnerability type: Incorrect Access Control. CVE ID: CVE-2024-22889 Description: Due to incorect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via...

plown

Informazioni Plown è uno scanner di sicurezza per il CMS Plone. Sebbene Plone abbia il miglior storico di sicurezza tra i principali CMS e sia considerato altamente sicuro, configurazioni errate e password deboli potrebbero consentire intrusioni nel sistema. Plown è stato sviluppato per facilitar...

plone-app-layout (>=4.0.0a1, <=4.0.0a4) potentially affected by CVE-2026-57149 via plone-app-portlets (5.0.2)

plone-app-portlets PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-portlets and may be impacted: - plone-app-layout =4.0.0a1, =4.0.0a4 Source cves: CVE-2026-57149 Source advisory: OSV:PYSEC-2026-4138...

plone-app-z3cform (>=4.0.0a1, <=4.0.0a10) potentially affected by CVE-2026-57576 via plone-app-dexterity (2.5.2)

plone-app-dexterity PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-dexterity and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: CVE-2026-57576 Source advisory: OSV:PYSEC-2026-4137...

PT-2026-105886

Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...

plone-app-z3cform (>=4.0.0a1, <=4.0.0a10) potentially affected by CVE-2026-57576 via plone-app-contenttypes (2.2.2)

plone-app-contenttypes PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-contenttypes and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: CVE-2026-57576 Source advisory: OSV:GHSA-8PCW-H6W9-H46G...

GHSA-8PCW-H6W9-H46G plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length

Impact When creating an Image or File with a very large filename, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.contenttypes. On Plone 6.2, upgrade to plone.app.contenttypes...

plone-app-z3cform (>=4.0.0a1, <=4.0.0a10) potentially affected by CVE-2026-57576 via plone-app-dexterity (2.5.2)

plone-app-dexterity PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-dexterity and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: CVE-2026-57576 Source advisory: OSV:GHSA-5426-92W4-WVHV...

plone.app.dexterity has a Denial of Service due to excessive title or description length

Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...

EUVD-2026-84980

plone.app.dexterity has a Denial of Service due to excessive title or description length...

plone-app-layout (>=4.0.0a1, <=4.0.0a4) potentially affected by CVE-2026-57149 via plone-app-portlets (5.0.2)

plone-app-portlets PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-portlets and may be impacted: - plone-app-layout =4.0.0a1, =4.0.0a4 Source cves: CVE-2026-57149 Source advisory: OSV:GHSA-RR49-F9G6-C9R5...

CVE-2026-57576

plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0...

plone.app.event vulnerable to denial of service via iCalendar import

ImpactBy abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. PatchesThe problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

GHSA-R82H-MQW3-FC56 plone.app.event vulnerable to denial of service via iCalendar import

Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. Patches The problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

plone.app.event vulnerable to denial of service via iCalendar import

Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. Patches The problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

CVE-2026-55247

plone.app.event , Plone's event content type, contains multiple issues in its iCalendar import (src/plone/app/event/ical/importer.py) prior to versions 5.2.4 and 6.0.1 . The importer accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported ...

Plone CMS detect

Detects Plone CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Plone CMS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Plone CMS detect', 'description': 'Detects Plone CMS', 'author': 'KittySploit Team',...

plone.app.textfield: Stored XSS by spoofing mime type

ImpactA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

PYSEC-2026-3497 plone.app.textfield: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...