Skip to content
OpenAdvisories

Vendor

plone

12 known vulnerabilities.

Products

volto 3 plone.app.portlets 2 Products.isurlinportal 2 plone.app.textfield 1 plone.namedfile 1 plone.rest 1 plone.app.event 1 plone.app.dexterity 1 plone.app.contenttypes 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.7
    CVE-2025-61668

    @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user

    Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to …

    plone volto @plone/volto npm
  • High 7.5
    CVE-2025-58047

    Volto affected by possible DoS by invoking specific URL by anonymous user

    Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part o…

    plone volto @plone/volto npm
  • High 7.5
    CVE-2023-42457

    plone.rest vulnerable to Denial of Service when ++api++ is used many times

    plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingl…

    plone plone.rest plone-rest PyPI