CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 17/07/2024 |
| CVE-2024-29885 | 中危4.3 | silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the `canView()` method for that report returns `false`. This issue has been addressed in versi | 17/07/2024 |
| CVE-2023-49783 | 中危4.3 | Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don't have edit or delete permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import form, | 23/01/2024 |
| CVE-2023-48714 | 中危4.3 | Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be | 23/01/2024 |
| CVE-2023-44401 | 中危5.3 | The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number of records is greater than the number of records per page. N | 23/01/2024 |
| CVE-2023-40180 | 高危7.5 | silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS pr | 16/10/2023 |
| CVE-2023-22729 | 中危6.1 | Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link. Users should upgrade to | 26/04/2023 |
| CVE-2023-22728 | 中危4.3 | Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users shou | 26/04/2023 |
| CVE-2023-28104 | 高危7.5 | `silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with particularly large/com | 16/03/2023 |
| CVE-2022-42949 | 高危7.5 | Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions. | 21/12/2022 |
| CVE-2022-38147 | 中危5.4 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3). | 23/11/2022 |
| CVE-2022-37421 | 中危5.4 | Silverstripe silverstripe/cms through 4.11.0 allows XSS. | 23/11/2022 |
| CVE-2022-38145 | 中危5.4 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view. | 23/11/2022 |
| CVE-2022-37430 | 中危5.4 | Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2). | 23/11/2022 |
| CVE-2022-37429 | 中危5.4 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. | 23/11/2022 |
| CVE-2022-38724 | 中危5.4 | Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS. | 23/11/2022 |
| CVE-2022-38462 | 中危6.1 | Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request. | 22/11/2022 |
| CVE-2022-38148 | 高危8.8 | Silverstripe silverstripe/framework through 4.11 allows SQL Injection. | 21/11/2022 |