89 matches found
Plone < 3.0.0 Multiple Vulnerabilities
The version of Plone installed on the remote host is prior to 3.0.0. It is, therefore, affected by the following vulnerabilities: - Plone places a base64 encoded form of the username and password in the ac cookie for the admin account, which makes it easier for remote attackers to obtain...
Plone < 3.3.6 / 4.0.x < 4.0.8 Privilege Escalation (HF 20110622)
The version of Plone installed on the remote host is prior to 3.3.6 or 4.0.x prior to 4.0.8. It is, therefore, affected by a privilege escalation vulnerability. An unauthenticated, remote attacker can exploit this to gain administrative access to the application. Note that Nessus has not tested f...
Plone 4.x < 4.0.10 / 4.1.x < 4.1.1 Multiple Vulnerabilities (HF 20110928)
The version of Plone installed on the remote host is 4.x prior to 4.0.10 or 4.1.x prior to 4.1.1. It is, therefore, affected by the following vulnerabilities: - Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used allows remote attackers to execute arbitrary commands via vectors related t...
Plone 3.3.x < 4.3.7 Multiple Vulnerabilities (HF 20150910)
The version of Plone installed on the remote host is 3.3.x prior to 4.3.7. It is, therefore, affected by the following vulnerabilities: - Plone allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator CVE-2015-7315 -...
Plone < 2.5.5 / 3.x < 3.3.6 / 4.x < 4.0.4 Privilege Escalation (HF 20110720)
The version of Plone installed on the remote host is prior to 2.5.5, 3.x prior to 3.3.6, or 4.x prior to 4.0.4. It is, therefore, affected by a privilege escalation vulnerability. An unauthenticated, remote attacker can exploit this to gain administrative access to the application. Note that Ness...
Plone 2.5.5 < 4.3.16 / 5.0.x < 5.0.10 Multiple Vulnerabilities (HF 20171128)
The version of Plone installed on the remote host is 2.5.5 prior to 4.3.16, 5.0.x prior to 5.0.10. It is, therefore, affected by the following vulnerabilities: - When you visit a page where you need to login, sends you to the login form with a 'camefrom' parameter set to the previous url...
Plone < 5.2.3 Multiple Vulnerabilities
The version of Plone installed on the remote host is prior to 5.2.3. It is, therefore, affected by the following vulnerabilities: - Plone allows XXE attacks via a feature that is explicitly only available to the Manager role. CVE-2020-28734 - Plone allows SSRF attacks via the tracebacks feature...
PYSEC-2026-2880 Improper Restriction of XML External Entity Reference in Plone
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
PYSEC-2026-896 Plone XSS Vulnerability
Cross-site scripting XSS vulnerability in skins/plonetemplates/defaulterrormessage.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the typename parameter to Members/ipa/createObject...
PYSEC-2026-733 Plone allows remote users to modify arbitrary portraits
Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...
PYSEC-2026-735 Improper Restriction of XML External Entity Reference in Plone
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...
CVE-2026-28413
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?camefrom=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0...
CVE-2026-28413
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?camefrom=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0...
CVE-2026-28413 Products.isurlinportal: Possible open redirect when using more than 2 forward slashes
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?camefrom=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0...
Plone Python Library Multiple Vulnerabilities (20230921)
The detected version of Plone python package, plone, is prior to version 5.2.14 or 6.x prior to 6.0.7. It is, therefore, affected by the following the vulnerabilities: - Multiple stored cross site scripting vulnerabilities exits when handling SVG images. An authenticated, remote attacker can...
CVE-2021-33512
Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...
CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...
EUVD-2017-0098
Malware in sbrugna...