droopescan

droopescan A plugin-based scanner that aids security researchers in identifying issues with several CMS. Usage of droopescan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume n...

silverstripe-cms-authz-poc

SilverStripe CMS — authorization flaws F1 / F4 Status: pu...

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected...

GHSA-68WQ-PHQ7-P2VG MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected...

CVE-2026-88992 - Userforms CSV export restricted file access

More info at https://www.silverstripe.org/download/security-releases/cve-2026-88992...

CVE-2026-88991 - RCE in email subject field via template execution

More info at https://www.silverstripe.org/download/security-releases/cve-2026-88991...

CVE-2026-91111 - Uploaded XML XSS

More info at https://www.silverstripe.org/download/security-releases/cve-2026-91111...

CVE-2026-88988 - XSS via SVG data URI

More info at https://www.silverstripe.org/download/security-releases/cve-2026-88988...

CVE-2026-91114 - Stored XSS via unescaped permission in PermissionCheckboxSetField

More info at https://www.silverstripe.org/download/security-releases/cve-2026-91114...

CVE-2026-91115 - RCE via i18nTextCollectorTask writer parameter

More info at https://www.silverstripe.org/download/security-releases/cve-2026-91115...

CVE-2026-91110 - XSS using control bytes

More info at https://www.silverstripe.org/download/security-releases/cve-2026-91110...

CVE-2026-91113 - User-controlled ClassName allows unauthorized record type change

More info at https://www.silverstripe.org/download/security-releases/cve-2026-91113...

CVE-2026-91112 - CMS_ACCESS_SecurityAdmin privilege escalation

More info at https://www.silverstripe.org/download/security-releases/cve-2026-91112...

CVE-2026-88987 - XSS via XHTML data URI

More info at https://www.silverstripe.org/download/security-releases/cve-2026-88987...

CVE-2026-88990 - RCE in email template field via template execution

More info at https://www.silverstripe.org/download/security-releases/cve-2026-88990...

CVE-2026-55779

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

silverstripe/versioned has XSS in archive admin restore

Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin Reporter Steve Boyd Silverstripe Ltd...

GHSA-M4G4-86QC-V8W7 silverstripe/versioned has XSS in archive admin restore

Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin Reporter Steve Boyd Silverstripe Ltd...

CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

EUVD-2026-68015

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...