Incorrect Permission Assignment for Critical Resource in Plone

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

GHSA-RMPV-RCP6-V8WC Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...

Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...

GHSA-HM2H-F456-6J88 Cross-site scripting in Plone

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

Cross-site scripting in Plone

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

GHSA-FJ67-W3M4-RFMP Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

Plone CMS <= 5.2.4 Multiple Vulnerabilities

Plone CMS is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cross-Site Scripting (XSS)

plone is vulnerable to cross-site scripting. The vulnerability exists due to the mishandling of the full name during rendering of the ownership tab of a content item...

Cross-Site Scripting (XSS)

plone is vulnerable to cross-site scripting. The package fails to sanitize the user fullname field allowing attackers to execute arbitrary JavaScript in a victim's browser...

Plone server-side request forgery vulnerability

Plone is the Plone Foundation's open source content management system running on the Zope application server. A server-side request forgery vulnerability exists in Plone 5.2.4 and earlier versions. An attacker can exploit this vulnerability to initiate a server-side request using the lxml parser...

Server Side Request Forgery

plone is vulnerable to server side request forgery. An attacker is able to submit requests on behalf of the server via the lxml parser...

Information Disclosure

plone is vulnerable to information disclosure. A remotely authenticated manager is able to perform disk I/O through malicious keyword arguments to ReStructuredText transform...

Cross-site Scripting (XSS)

plone is vulnerable to cross-site scripting. An attacker is able to inject malicious script via uploading an SVG or HTML document. This allows an attacker to exploit it to inject and execute javascript...

Server Side Request Forgery (SSRF)

plone is vulnerable to server side request forgery. An attacker is able to submit requests on behalf of the server via an event ical URL...

Cross-site Scripting (XSS)

productscmfcore, productspluggableauthservice and plone are vulnerable to cross-site scripting. An attacker is able to inject malicious script through unsanitized user-provided arguments...

Plone server-side request forgery vulnerability (CNVD-2021-37196)

Plone is an open source content management system CMS built on the Zope application server. A server-side request forgery vulnerability exists in Plone 5.2.4 and earlier versions. An authenticated remote attacker can exploit this vulnerability to read a line in a file...

Plone cross-site scripting vulnerability (CNVD-2021-37274)

Plone is the industry's leading open source CMS system for content management, document management and knowledge management. A stored cross-site scripting vulnerability exists in Plone 5.2.4 and earlier versions. The vulnerability can be exploited by uploading SVG or HTML documents to conduct...

Plone cross-site scripting vulnerability (CNVD-2021-37275)

Plone is the industry's leading open source CMS system for content management, document management and knowledge management. A cross-site scripting vulnerability exists in Plone 5.2.4 and earlier versions. The vulnerability can be exploited to conduct cross-site scripting attacks via the inlinedi...

Plone cross-site scripting vulnerability (CNVD-2021-37195)

Plone is an open source content management system CMS built on the Zope application server. A cross-site scripting vulnerability exists in Plone versions prior to 5.2.4. The vulnerability can be exploited to cause cross-site scripting with the help of "fullname"...