| CVE-2025-46047 | TRUNG BÌNH6.5 | A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter. | 02/09/2025 |
| CVE-2025-45055 | TRUNG BÌNH5.4 | Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attackers to escalate privile | 09/06/2025 |
| CVE-2024-56923 | TRUNG BÌNH5.4 | Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to | 22/01/2025 |
| CVE-2024-48814 | CAO7.5 | SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the findbywhereclause function | 03/01/2025 |
| CVE-2024-42850 | NGHIÊM TRỌNG9.8 | An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. | 16/08/2024 |
| CVE-2024-42849 | TRUNG BÌNH6.5 | An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function. | 16/08/2024 |
| CVE-2024-39031 | TRUNG BÌNH5.4 | In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and | 09/07/2024 |
| CVE-2024-36042 | NGHIÊM TRỌNG9.8 | Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access. | 03/06/2024 |
| CVE-2024-29392 | TRUNG BÌNH5.4 | Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController. | 22/05/2024 |
| CVE-2023-47327 | TRUNG BÌNH4.3 | The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL. | 13/12/2023 |
| CVE-2023-47326 | CAO8.8 | Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function. | 13/12/2023 |
| CVE-2023-47325 | TRUNG BÌNH5.4 | Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces. | 13/12/2023 |
| CVE-2023-47324 | TRUNG BÌNH5.4 | Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. | 13/12/2023 |
| CVE-2023-47323 | CAO7.5 | The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators. | 13/12/2023 |
| CVE-2023-47322 | CAO8.8 | The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application. | 13/12/2023 |
| CVE-2023-47321 | TRUNG BÌNH4.9 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. | 13/12/2023 |
| CVE-2023-47320 | CAO8.1 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and b | 13/12/2023 |
| CVE-2018-19586 | NGHIÊM TRỌNG9.9 | Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the underlying system with priv | 09/04/2019 |