plone-app-event

4 results · Feed

• Critical 9.1
  CVE-2026-55247

  plone.app.event: Denial of service via iCalendar import

  plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or…

  plone plone.app.event plone-app-event PyPI
  Aug 28, 2026
• High 8.8
  CVE-2020-28736

  Improper Restriction of XML External Entity Reference in Plone

  Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

  plone plone-app-event plone-app-dexterity plone-app-theming PyPI
  Dec 30, 2020
• High 8.8
  CVE-2020-28735

  SSRF attacks via tracebacks in Plone

  Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

  plone plone-app-dexterity plone-app-event plone-app-theming PyPI
  Dec 30, 2020
• High 8.8
  CVE-2020-28734

  Improper Restriction of XML External Entity Reference in Plone

  Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

  plone plone-app-event plone-app-dexterity plone-app-theming PyPI
  Dec 30, 2020