CVE 検索

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In versions prior to 6.2.2, the "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. This issue was fixed in version 6.2.2/

Silverstripe Framework user enumeration via timing attack on login and password reset forms

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized

Reflected Cross Site Scripting (XSS) in error message

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In some cases, form messages can contain HTML markup. This is an intentional feature, allowing links and other relevant HTML markup for the given message. Some form messages include content that the user can provide. There are scenarios in the

silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on bot

Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message

Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload

Silverstripe uses TinyMCE which allows svg files linked in object tags

silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector

silverstripe/framework has possible denial of service attack vector when flushing

silverstripe/framework may disclose database credentials during connection failure

silverstripe/framework allows upload of dangerous file types

silverstripe/framework vulnerable to member disclosure in login form

silverstripe/framework sends passwords back to browsers under some circumstances

silverstripe/framework uploaded PHP script execution in assets

silverstripe/framework code execution vulnerability

silverstripe/framework BackURL validation bypass with malformed URLs

silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms

silverstripe/framework Privilege Escalation Risk in Member Edit form