Skip to content
OpenAdvisories

Package · Packagist

silverstripe/framework

93 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

91 results · Feed

  • Medium 5.4
    CVE-2019-14272

    SilverStripe asset-admin Cross-site Scripting (XSS)

    In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.

    silverstripe/framework Packagist
  • Medium 5.3
    CVE-2019-14273

    Broken access control on files

    In SilverStripe assets 4.0, there is broken access control on files.

    silverstripe/framework Packagist
  • Medium 6.1
    CVE-2019-12205

    Silverstripe Flash Clipboard Reflected XSS

    SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.

    silverstripe/framework silverstripe/admin Packagist
  • Medium 6.3
    CVE-2019-12203

    Session fixation in change password form

    SilverStripe through 4.3.3 allows session fixation in the "change password" form.

    silverstripe/framework Packagist
  • Medium 5.3
    CVE-2019-12245

    Lack of access control on upoaded files

    SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.

    silverstripe/framework silverstripe/assets Packagist
  • Critical 9.8
    CVE-2019-12204

    Missing warning can lead to unauthenticated admin access in SilverStripe

    In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.

    silverstripe/framework silverstripe/cms Packagist
  • Critical 9.8
    CVE-2019-5715

    Silverstripe Framework SQLi Vulnerability

    All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject.

    silverstripe/framework Packagist
  • Medium 5.5
    CVE-2017-18049

    SilverStripe CSV Excel Macro Injection

    In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software (including Microsoft Exce…

    silverstripe/framework Packagist
  • Medium —
    CVE-2015-5062

    Silverstripe CMS Open Redirect

    Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build.

    silverstripe/framework silverstripe/cms Packagist
  • Medium —
    CVE-2012-4968

    Silverstripe XSS Vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted string to the AbsoluteLinks, (2) BigSummary, (3) ContextSummary, (4)…

    silverstripe/framework Packagist
  • Low —
    CVE-2010-1593

    SilverStripe vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2…

    silverstripe/framework silverstripe/cms Packagist