| CVE-2026-33326 | TRUNG BÌNH4.3 | Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update | 24/03/2026 |
| CVE-2025-46720 | TRUNG BÌNH4.3 | Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mutations by adding additional unique filters. These filters can be used as an oracle to probe the existence or value of otherwise unreadable fields. Specifically, | 05/05/2025 |
| CVE-2023-40027 | TRUNG BÌNH5.3 | Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly ac | 15/08/2023 |
| CVE-2023-34247 | TRUNG BÌNH4.1 | Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to a | 13/06/2023 |
| CVE-2022-39382 | NGHIÊM TRỌNG9.8 | Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/ [email protected] || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `NODE_ENV` being inlined to `"development"` for user code, irrespective of what your environment vari | 03/11/2022 |
| CVE-2022-39322 | NGHIÊM TRỌNG9.8 | @keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulnerable to their field-level access control not being used. Lis | 25/10/2022 |
| CVE-2022-29354 | NGHIÊM TRỌNG9.8 | An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file. | 16/05/2022 |
| CVE-2022-0087 | TRUNG BÌNH6.1 | keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 12/01/2022 |
| CVE-2015-9240 | CAO7.5 | Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in. | 29/05/2018 |
| CVE-2017-16570 | CAO8.8 | KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header. | 06/11/2017 |
| CVE-2017-15881 | TRUNG BÌNH4.8 | Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vulnerability than CVE-2017-15878. | 24/10/2017 |
| CVE-2017-15879 | CAO8.8 | CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export. | 24/10/2017 |
| CVE-2017-15878 | TRUNG BÌNH6.1 | A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature. | 24/10/2017 |