CVE-2021-33510

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

CVE-2021-33510

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

CVE-2021-33511

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

CVE-2021-33511

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

CVE-2021-33511

CVE-2021-33511: Plone (

CVE-2021-33512

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

CVE-2021-33512

Plone up to version 5.2.4 is affected by a stored XSS vulnerability. The issue allows an attacker (Contributor) to upload an SVG or HTML document, enabling stored cross-site scripting in affected content. Root cause is improper handling of file uploads that can inject script into pages. Affected:...

CVE-2021-33512

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

CVE-2021-33513

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

CVE-2021-33513

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

CVE-2021-33513

CVE-2021-33513 affects Plone up to version 5.2.4, where cross-site scripting is possible via the inline_diff methods in Products.CMFDiffTool. The root cause is an XSS flaw in CMFDiffTool’s inline_diff implementation. Public references indicate a specific security fix was released as a Plone hotfi...

Cross-Site Scripting (XSS)

plone is vulnerable to cross-site scripting. An attacker is able to exploit the vulnerability by injecting script via the user fullname property and file upload functionality...

PT-2021-20165

Name of the Vulnerable Software and Affected Versions Plone versions through 5.2.4 Description The issue allows for cross-site scripting XSS due to the mishandling of a full name during the rendering of the ownership tab of a content item. Recommendations For versions through 5.2.4, update to a...

Plone cross-site scripting vulnerability (CNVD-2021-37279)

Plone is a foreign open source CMS system suitable for enterprise-level applications. A cross-site scripting vulnerability exists in the user full name attribute and file upload functionality in Plone CMS versions prior to 5.2.4. The vulnerability stems from user input that is not properly encode...

Plone 跨站脚本漏洞

Plone is an open source content management system CMS built on the Zope application server. A cross-site scripting vulnerability exists in Plone versions prior to 5.2.4. The vulnerability can be exploited to cause cross-site scripting with the help of "fullname"...

CVE-2021-33507: Improper Neutralization of Input During Web Page Generation

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...

CVE-2021-33510: Server-Side Request Forgery (SSRF)

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

CVE-2021-33513: Improper Neutralization of Input During Web Page Generation

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

Plone 安全漏洞

Plone is an open source content management system CMS built on the Zope application server. An arbitrary file write vulnerability exists in Plone 5.2.4 and earlier versions. A remote attacker can exploit this vulnerability to perform disk I/O via specially crafted keyword arguments converted by...

CVE-2021-33509: Incorrect Permission Assignment for Critical Resource

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...