CVE-2019-12245

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile. An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension...

EUVD-2020-0310

Malware in sbrugna...

EUVD-2010-5044

Malware in sbrugna...

EUVD-2011-4868

Malware in sbrugna...

EUVD-2010-5051

Malware in sbrugna...

EUVD-2010-5054

Malware in sbrugna...

EUVD-2013-2592

Malware in sbrugna...

EUVD-2025-10683

Malicious code in bioql PyPI...

EUVD-2022-3848

Malicious code in bioql PyPI...

EUVD-2022-5644

Malicious code in bioql PyPI...

CVE-2010-5094

The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, which allows remote attackers to delete index.php and "disrupt modrewrite-less URL routing."...

CVE-2009-1433

SQL injection vulnerability in File::find filesystem/File.php in SilverStripe before 2.3.1 allows remote attackers to execute arbitrary SQL commands via the filename parameter...

SilverStripe 5.3.8 - Stored Cross Site Scripting (XSS) (Authenticated)

Exploit Title: SilverStripe 5.3.8 - Stored Cross Site Scripting XSS Authenticated Date: 2025-01-15 Exploit Author: James Nicoll Vendor Homepage: https://www.silverstripe.org/ Software Link: https://www.silverstripe.org/download/ Category: Web Application Version: 5.2.22 Tested on: SilverStripe...

Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report

An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability is specific to that report and is a result of failure to cast input prior to including it in the grid field. References -...

GHSA-WG4M-VVP6-2HC5 SilverStripe vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via 1 the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject...

CVE-2019-12204

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access...

SS-2018-006: Code execution vulnerability

More info at https://www.silverstripe.org/download/security-releases/ss-2018-006/...

SS-2016-007: VersionedRequestFilter vulnerability

More info at https://www.silverstripe.org/download/security-releases/ss-2016-007/...