Browse CVEs

MEDIUM 6.1 CVE-2026-28413 Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil… Isurlinportal 2.1.0 / 3.1.0+ Fix from $1,6002026-03-05 HIGH 7.5 CVE-2024-22889 Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted req… Plone Mitigation only Fix from $1,9502024-03-06 HIGH 7.5 CVE-2024-23756 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangero… Plone No fix yet Fix from $1,9502024-02-08 CRITICAL 9.8 CVE-2024-23054 An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++pl… Plone Docker Official Image Mitigation only Fix from $2,3002024-02-05 MEDIUM 6.1 CVE-2024-23055 An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the H… Plone Docker Official Image No fix yet Fix from $1,6002024-01-25 HIGH 7.1 CVE-2024-0669 A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opene… Plone 6.0.7+ Fix from $1,9502024-01-18 HIGH 7.5 CVE-2023-42457 plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3… Rest Patch available Fix from $1,9502023-09-21 MEDIUM 5.4 CVE-2023-41048 plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6… Namedfile 5.6.1 / 6.0.3+ Fix from $1,6002023-09-21 HIGH 8.8 CVE-2021-33926 An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1… Plone No fix yet Fix from $1,9502023-02-17 HIGH 7.5 CVE-2022-24740 Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have thei… Volto after 14.10.0 Fix from $1,9502022-03-14 MEDIUM 6.1 CVE-2022-23599 Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to vers… Plone 3.0.6+ Fix from $1,6002022-01-28 MEDIUM 6.1 CVE-2021-32806 Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vu… Isurlinportal 1.2.0+ Fix from $1,6002021-08-02 MEDIUM 5.4 CVE-2021-35959 In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the… Plone after 5.2.4 Fix from $1,6002021-06-30 CRITICAL 9.9 CVE-2021-33509 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Pyt… Plone after 5.2.4 Fix from $2,3002021-05-21 HIGH 7.5 CVE-2021-33511 Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.ap… Plone after 5.2.4 Fix from $1,9502021-05-21 MEDIUM 6.1 CVE-2021-33507 Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected… Plone 2.5.1+ Fix from $1,6002021-05-21 MEDIUM 5.4 CVE-2021-33508 Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item. Plone after 5.2.4 Fix from $1,6002021-05-21 MEDIUM 5.4 CVE-2021-33512 Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. Plone after 5.2.4 Fix from $1,6002021-05-21 MEDIUM 5.4 CVE-2021-33513 Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. Plone after 5.2.4 Fix from $1,6002021-05-21 HIGH 8.8 CVE-2021-32633 Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python mo… Plone 4.6 / 5.2+ Fix from $1,9502021-05-21 MEDIUM 5.4 CVE-2021-3313 Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. … Plone 5.2.4+ Fix from $1,6002021-05-20 MEDIUM 5.4 CVE-2021-29002 A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter. Plone No fix yet Fix from $1,6002021-03-24 HIGH 8.8 CVE-2020-28734 Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. Plone 5.2.3+ Fix from $1,9502020-12-30 HIGH 8.8 CVE-2020-28735 Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). Plone 5.2.3+ Fix from $1,9502020-12-30 HIGH 8.8 CVE-2020-28736 Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, onl… Plone 5.2.3+ Fix from $1,9502020-12-30 CRITICAL 9.8 CVE-2020-35190 The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone d… Plone 4.3.18-alpine+ Fix from $2,3002020-12-17 CRITICAL 9.8 CVE-2020-7941 A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write … Plone after 5.2.1 Fix from $2,3002020-01-23 HIGH 8.8 CVE-2020-7938 plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level. Plone after 5.2.1 Fix from $1,9502020-01-23 HIGH 8.8 CVE-2020-7939 SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.) Plone after 5.2.1 Fix from $1,9502020-01-23 HIGH 7.5 CVE-2020-7940 Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. Plone after 5.2.0 Fix from $1,9502020-01-23