CVE-2021-33511

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

PYSEC-2021-85

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

PYSEC-2021-82

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

PYSEC-2021-85

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

Code injection

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

PYSEC-2021-81

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

PYSEC-2021-83

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

CVE-2021-33507

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...

CVE-2021-33508

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...

CVE-2021-33508

The CVE-2021-33508 entry describes a XSS vulnerability in Plone versions up to 5.2.4 where the user’s full name is mishandled during rendering of the ownership tab, enabling cross-site scripting. Affected product: Plone CMS (up to 5.2.4). Root cause: improper handling of the fullname field in the...

CVE-2021-33509

Plone 5.2.4 and earlier are affected by an arbitrary file-write vulnerability. Remote authenticated managers can cause disk I/O by sending crafted keyword arguments to the ReStructuredText transform in Python scripts, enabling potential file writes to the server. Root cause is exposed via docutil...

CVE-2021-33509

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

CVE-2021-33510

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

CVE-2021-33510

Plone CMS with versions up to 5.2.4 is affected by a server-side request forgery (SSRF) vulnerability allowing remote authenticated managers to fetch an event iCal URL and read one line of a file. The root cause is an SSRF flaw in handling the event iCal URL, leading to data exposure. The provide...

CVE-2021-33511

CVE-2021-33511: Plone (

CVE-2021-33511

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

CVE-2021-33512

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

CVE-2021-33512

Plone up to version 5.2.4 is affected by a stored XSS vulnerability. The issue allows an attacker (Contributor) to upload an SVG or HTML document, enabling stored cross-site scripting in affected content. Root cause is improper handling of file uploads that can inject script into pages. Affected:...

CVE-2021-33513

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

CVE-2021-33513

CVE-2021-33513 affects Plone up to version 5.2.4, where cross-site scripting is possible via the inline_diff methods in Products.CMFDiffTool. The root cause is an XSS flaw in CMFDiffTool’s inline_diff implementation. Public references indicate a specific security fix was released as a Plone hotfi...