silverstripe/framework (Packagist)
Advisories
193
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 6.2.2 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require silverstripe/framework:^6.2.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-gvrw-qqp5-jgc5 Silverstripe Framework: Possible XSS attack through media embed |
Medium EPSS 0.26% |
< 6.2.2 | 6.2.2 |
| GHSA-256q-hx8w-xcqx Silverstripe Framework user enumeration via timing attack on login and password reset forms |
Medium | >= 4.0.0, < 5.3.23 | 5.3.23 |
| GHSA-rhx4-hvx9-j387 Silverstripe Framework has a XSS vulnerability in HTML editor |
Medium EPSS 0.29% |
< 5.3.23 | 5.3.23 |
| GHSA-74j9-xhqr-6qv3 Reflected Cross Site Scripting (XSS) in error message |
Low | < 5.3.8 | 5.3.8 |
| GHSA-mqf3-qpc3-g26q Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message |
Low | < 5.3.8 | 5.3.8 |
| GHSA-ff6q-3c9c-6cf5 Silverstripe Framework has a XSS in form messages |
Medium EPSS 0.33% |
< 5.3.8 | 5.3.8 |
| GHSA-7cmp-cgg8-4c82 Silverstripe Framework has a XSS via insert media remote file oembed |
Medium EPSS 1.18% |
< 5.3.8 | 5.3.8 |
| GHSA-52cw-pvq9-9m5v Silverstripe uses TinyMCE which allows svg files linked in object tags |
Medium | < 5.2.16 | 5.2.16 |
| GHSA-chx7-9x8h-r5mg Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload |
Medium EPSS 0.35% |
< 5.2.16 | 5.2.16 |
| GHSA-265q-222x-52m6 silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector |
High | >= 4.2.0-rc1, < 4.2.3 | 4.2.3 |
| GHSA-265q-222x-52m6 silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector |
High | >= 4.0.0-rc1, < 4.0.6 | 4.0.6 |
| GHSA-265q-222x-52m6 silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector |
High | >= 4.1.0-rc1, < 4.1.4 | 4.1.4 |
| GHSA-cwgq-83w5-8jfq silverstripe/framework has possible denial of service attack vector when flushing |
High | >= 4.2.0-rc1, < 4.2.2 | 4.2.2 |
| GHSA-cwgq-83w5-8jfq silverstripe/framework has possible denial of service attack vector when flushing |
High | >= 4.0.0-rc1, < 4.0.5 | 4.0.5 |
| GHSA-cwgq-83w5-8jfq silverstripe/framework has possible denial of service attack vector when flushing |
High | >= 4.1.0-rc1, < 4.1.3 | 4.1.3 |
| GHSA-m2hh-2m46-x6j5 silverstripe/framework may disclose database credentials during connection failure |
Medium | >= 4.2.0-rc1, < 4.2.2 | 4.2.2 |
| GHSA-m2hh-2m46-x6j5 silverstripe/framework may disclose database credentials during connection failure |
Medium | >= 4.0.0-rc1, < 4.0.5 | 4.0.5 |
| GHSA-m2hh-2m46-x6j5 silverstripe/framework may disclose database credentials during connection failure |
Medium | >= 3.7.0-rc1, < 3.7.1 | 3.7.1 |
| GHSA-m2hh-2m46-x6j5 silverstripe/framework may disclose database credentials during connection failure |
Medium | >= 4.1.0-rc1, < 4.1.3 | 4.1.3 |
| GHSA-vcg6-8fxc-x5cq silverstripe/framework allows upload of dangerous file types |
High | >= 4.1.0-rc1, < 4.1.1 | 4.1.1 |
| GHSA-vcg6-8fxc-x5cq silverstripe/framework allows upload of dangerous file types |
High | >= 4.0.3-rc1, < 4.0.4 | 4.0.4 |
| GHSA-vcg6-8fxc-x5cq silverstripe/framework allows upload of dangerous file types |
High | >= 3.6.5-rc1, < 3.6.6 | 3.6.6 |
| GHSA-crr3-h4m8-7f56 silverstripe/framework vulnerable to member disclosure in login form |
Medium | >= 4.0.0-rc1, < 4.0.4 | 4.0.4 |
| GHSA-crr3-h4m8-7f56 silverstripe/framework vulnerable to member disclosure in login form |
Medium | >= 4.1.0-rc1, < 4.1.1 | 4.1.1 |
| GHSA-vh7q-j8p5-2h4h silverstripe/framework sends passwords back to browsers under some circumstances |
Low | >= 4.0.3-rc1, < 4.0.4 | 4.0.4 |
| GHSA-vh7q-j8p5-2h4h silverstripe/framework sends passwords back to browsers under some circumstances |
Low | >= 4.1.0-rc1, < 4.1.1 | 4.1.1 |
| GHSA-vh7q-j8p5-2h4h silverstripe/framework sends passwords back to browsers under some circumstances |
Low | >= 3.5.5-rc1, < 3.7.0 | 3.7.0 |
| GHSA-f43j-8hq4-2xj9 silverstripe/framework uploaded PHP script execution in assets |
Medium | >= 4.0.0-rc1, < 4.0.4 | 4.0.4 |
| GHSA-f43j-8hq4-2xj9 silverstripe/framework uploaded PHP script execution in assets |
Medium | >= 4.1.0-rc1, < 4.1.1 | 4.1.1 |
| GHSA-vgxh-x8jv-hmff silverstripe/framework code execution vulnerability |
High | >= 4.1.0-rc1, < 4.1.1 | 4.1.1 |
| GHSA-vgxh-x8jv-hmff silverstripe/framework code execution vulnerability |
High | >= 4.0.3-rc1, < 4.0.4 | 4.0.4 |
| GHSA-m5q3-mvcr-gc5m silverstripe/framework BackURL validation bypass with malformed URLs |
High | >= 4.0.0-rc1, < 4.0.4 | 4.0.4 |
| GHSA-m5q3-mvcr-gc5m silverstripe/framework BackURL validation bypass with malformed URLs |
High | >= 4.1.0-rc1, < 4.1.1 | 4.1.1 |
| GHSA-r3pr-fh25-wrfc silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms |
Medium | >= 4.0.0-rc1, < 4.0.1 | 4.0.1 |
| GHSA-xpff-c35g-j3cr silverstripe/framework Privilege Escalation Risk in Member Edit form |
Medium | >= 4.1.0-rc1, < 4.1.1 | 4.1.1 |
| GHSA-xpff-c35g-j3cr silverstripe/framework Privilege Escalation Risk in Member Edit form |
Medium | >= 4.0.0-rc1, < 4.0.4 | 4.0.4 |
| GHSA-xpff-c35g-j3cr silverstripe/framework Privilege Escalation Risk in Member Edit form |
Medium | >= 3.6.0-rc1, < 3.6.6 | 3.6.6 |
| GHSA-xpff-c35g-j3cr silverstripe/framework Privilege Escalation Risk in Member Edit form |
Medium | >= 3.5.7-rc1, < 3.5.8 | 3.5.8 |
| GHSA-55qg-6c4m-mw6g silverstripe/framework's URL parameters `isDev` and `isTest` unguarded |
Medium | >= 4.0.0-rc1, < 4.0.4 | 4.0.4 |
| GHSA-55qg-6c4m-mw6g silverstripe/framework's URL parameters `isDev` and `isTest` unguarded |
Medium | >= 4.1.0rc1, < 4.1.1 | 4.1.1 |
| GHSA-xx4r-5265-48j6 silverstripe/framework SQL injection in full text search |
High | >= 3.5.0-rc1, < 3.5.6 | 3.5.6 |
| GHSA-xx4r-5265-48j6 silverstripe/framework SQL injection in full text search |
High | >= 4.0.0-rc1, < 4.0.1 | 4.0.1 |
| GHSA-xx4r-5265-48j6 silverstripe/framework SQL injection in full text search |
High | >= 3.6.0-rc1, < 3.6.3 | 3.6.3 |
| GHSA-ph62-fv59-vf9h silverstripe/framework users inadvertently passing sensitive data to LoginAttempt |
Medium | >= 3.5.0-rc1, < 3.5.6 | 3.5.6 |
| GHSA-ph62-fv59-vf9h silverstripe/framework users inadvertently passing sensitive data to LoginAttempt |
Medium | >= 3.6.0-rc1, < 3.6.3 | 3.6.3 |
| GHSA-ph62-fv59-vf9h silverstripe/framework users inadvertently passing sensitive data to LoginAttempt |
Medium | >= 4.0.0-rc1, < 4.0.1 | 4.0.1 |
| GHSA-mqjc-x563-c9q8 silverstripe/framework CSV Excel Macro Injection |
High | >= 3.6.0-rc1, < 3.6.3 | 3.6.3 |
| GHSA-mqjc-x563-c9q8 silverstripe/framework CSV Excel Macro Injection |
High | >= 3.5.0-rc1, < 3.5.6 | 3.5.6 |
| GHSA-mqjc-x563-c9q8 silverstripe/framework CSV Excel Macro Injection |
High | >= 4.0.0-rc1, < 4.0.1 | 4.0.1 |
| GHSA-7m2v-x7rg-5hm5 silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms |
High | >= 3.5.0-rc1, < 3.5.5 | 3.5.5 |
| GHSA-7m2v-x7rg-5hm5 silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms |
High | >= 3.6.0-rc1, < 3.6.2 | 3.6.2 |
| GHSA-4qx8-j9vh-2628 silverstripe/framework's User-Agent header not correctly invalidating user session |
High | >= 3.6.0-rc1, < 3.6.3 | 3.6.3 |
| GHSA-4qx8-j9vh-2628 silverstripe/framework's User-Agent header not correctly invalidating user session |
High | >= 3.5.0-rc1, < 3.5.6 | 3.5.6 |
| GHSA-c4c3-j73v-634r silverstripe/framework has Cross-site Scripting vulnerability in page history comparison |
Medium | >= 3.4.0-rc1, < 3.4.6 | 3.4.6 |
| GHSA-c4c3-j73v-634r silverstripe/framework has Cross-site Scripting vulnerability in page history comparison |
Medium | >= 3.5.0-rc1, < 3.5.4 | 3.5.4 |
| GHSA-pp7q-6j3f-74vj silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage |
Medium | >= 3.5.0-rc1, < 3.5.4 | 3.5.4 |
| GHSA-pp7q-6j3f-74vj silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage |
Medium | >= 3.4.0-rc1, < 3.4.6 | 3.4.6 |
| GHSA-r85g-7jpv-8xrx silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL |
Medium | >= 3.1.0-rc1, < 3.1.21 | 3.1.21 |
| GHSA-r85g-7jpv-8xrx silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL |
Medium | >= 3.4.0-rc1, < 3.4.2 | 3.4.2 |
| GHSA-r85g-7jpv-8xrx silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL |
Medium | >= 3.3.0-rc1, < 3.3.4 | 3.3.4 |
| GHSA-r85g-7jpv-8xrx silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL |
Medium | >= 3.2.0-rc1, < 3.2.6 | 3.2.6 |
| GHSA-hhvj-mcrx-3vcf silverstripe/framework has Cross-site Scripting vulnerability in page name |
Medium | >= 3.4.0-rc1, < 3.4.4 | 3.4.4 |
| GHSA-hhvj-mcrx-3vcf silverstripe/framework has Cross-site Scripting vulnerability in page name |
Medium | >= 3.5.0-rc1, < 3.5.2 | 3.5.2 |
| GHSA-g84q-cq55-xwgp silverstripe/framework member disclosure in login form |
Medium | >= 3.5.0-rc1, < 3.5.4 | 3.5.4 |
| GHSA-g84q-cq55-xwgp silverstripe/framework member disclosure in login form |
Medium | >= 3.4.0-rc1, < 3.4.6 | 3.4.6 |
| GHSA-468j-6jrc-2rjx silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField` |
Medium | >= 3.3.2-rc1, < 3.3.3 | 3.3.3 |
| GHSA-468j-6jrc-2rjx silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField` |
Medium | >= 3.4.0-rc1, < 3.4.1 | 3.4.1 |
| GHSA-468j-6jrc-2rjx silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField` |
Medium | >= 3.1.19-rc1, < 3.1.20 | 3.1.20 |
| GHSA-468j-6jrc-2rjx silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField` |
Medium | >= 3.2.4-rc1, < 3.2.5 | 3.2.5 |
| GHSA-r9vp-fp72-xgf7 silverstripe/framework's `Member.Name` is not escaped |
Medium | >= 3.3.2-rc1, < 3.3.3 | 3.3.3 |
| GHSA-r9vp-fp72-xgf7 silverstripe/framework's `Member.Name` is not escaped |
Medium | >= 3.4.0-rc1, < 3.4.1 | 3.4.1 |
| GHSA-r9vp-fp72-xgf7 silverstripe/framework's `Member.Name` is not escaped |
Medium | >= 3.1.9-rc1, < 3.1.20 | 3.1.20 |
| GHSA-r9vp-fp72-xgf7 silverstripe/framework's `Member.Name` is not escaped |
Medium | >= 3.2.4-rc1, < 3.2.5 | 3.2.5 |
| GHSA-5r8w-66hq-rc39 silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled |
Low | >= 3.2.4-rc1, < 3.2.5 | 3.2.5 |
| GHSA-5r8w-66hq-rc39 silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled |
Low | >= 3.4.0-rc1, < 3.4.1 | 3.4.1 |
| GHSA-5r8w-66hq-rc39 silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled |
Low | >= 3.3.2-rc1, < 3.3.3 | 3.3.3 |
| GHSA-5r8w-66hq-rc39 silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled |
Low | >= 3.1.19-rc1, < 3.1.20 | 3.1.20 |
| GHSA-52cx-hpc5-cxwc silverstripe/framework missing ACL on reports |
Medium | >= 3.1.19-rc1, < 3.1.20 | 3.1.20 |
| GHSA-52cx-hpc5-cxwc silverstripe/framework missing ACL on reports |
Medium | >= 3.2.4-rc1, < 3.2.5 | 3.2.5 |
| GHSA-52cx-hpc5-cxwc silverstripe/framework missing ACL on reports |
Medium | >= 3.3.2-rc1, < 3.3.3 | 3.3.3 |
| GHSA-52cx-hpc5-cxwc silverstripe/framework missing ACL on reports |
Medium | >= 3.4.0-rc1, < 3.4.1 | 3.4.1 |
| GHSA-p5h2-vr99-xm99 silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()` |
Medium | >= 3.2.4-rc1, < 3.2.5 | 3.2.5 |
| GHSA-p5h2-vr99-xm99 silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()` |
Medium | >= 3.4.0-rc1, < 3.4.1 | 3.4.1 |
| GHSA-p5h2-vr99-xm99 silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()` |
Medium | >= 3.3.2-rc1, < 3.3.3 | 3.3.3 |
| GHSA-p5h2-vr99-xm99 silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()` |
Medium | >= 3.1.19-rc1, < 3.1.20 | 3.1.20 |
| GHSA-f3wp-xpv2-6vmg silverstripe/framework password encryption salt not updated |
Low | >= 3.3.2-rc1, < 3.3.3 | 3.3.3 |
| GHSA-f3wp-xpv2-6vmg silverstripe/framework password encryption salt not updated |
Low | >= 3.2.4-rc1, < 3.2.5 | 3.2.5 |
| GHSA-f3wp-xpv2-6vmg silverstripe/framework password encryption salt not updated |
Low | >= 3.1.19-rc1, < 3.1.20 | 3.1.20 |
| GHSA-f3wp-xpv2-6vmg silverstripe/framework password encryption salt not updated |
Low | >= 3.4.0-rc1, < 3.4.1 | 3.4.1 |
| GHSA-97jm-g33h-f46g silverstripe/framework ReadOnly transformation for formfields exploitable |
Medium | >= 3.4.0, < 3.4.2 | 3.4.2 |
| GHSA-97jm-g33h-f46g silverstripe/framework ReadOnly transformation for formfields exploitable |
Medium | >= 3.3.0, < 3.3.4 | 3.3.4 |
| GHSA-97jm-g33h-f46g silverstripe/framework ReadOnly transformation for formfields exploitable |
Medium | >= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-97jm-g33h-f46g silverstripe/framework ReadOnly transformation for formfields exploitable |
Medium | < 3.1.21 | 3.1.21 |
| GHSA-mpqj-f4v3-334h Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter |
Medium | >= 3.3.2, < 3.3.3 | 3.3.3 |
| GHSA-mpqj-f4v3-334h Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter |
Medium | >= 3.4.0, < 3.4.1 | 3.4.1 |
| GHSA-vj2j-6g3w-4662 Silverstripe Missing CSRF protection in login form |
Medium | >= 3.1.18, < 3.1.19 | 3.1.19 |
| GHSA-vj2j-6g3w-4662 Silverstripe Missing CSRF protection in login form |
Medium | >= 3.3.1, < 3.3.2 | 3.3.2 |
| GHSA-vj2j-6g3w-4662 Silverstripe Missing CSRF protection in login form |
Medium | >= 3.2.3, < 3.2.4 | 3.2.4 |
| GHSA-8v6m-7f5v-hhx6 Silverstripe Brute force bypass on default admin |
Critical | >= 3.1.18, < 3.1.19 | 3.1.19 |
| GHSA-8v6m-7f5v-hhx6 Silverstripe Brute force bypass on default admin |
Critical | >= 3.3.1, < 3.3.2 | 3.3.2 |
| GHSA-8v6m-7f5v-hhx6 Silverstripe Brute force bypass on default admin |
Critical | >= 3.2.3, < 3.2.4 | 3.2.4 |
| GHSA-m8v7-x398-pxrf Silverstripe XSS in CMS Edit Page |
Medium | >= 3.3.1, < 3.3.2 | 3.3.2 |
| GHSA-m8v7-x398-pxrf Silverstripe XSS in CMS Edit Page |
Medium | >= 3.1.18, < 3.1.19 | 3.1.19 |
| GHSA-m8v7-x398-pxrf Silverstripe XSS in CMS Edit Page |
Medium | >= 3.2.3, < 3.2.4 | 3.2.4 |
| GHSA-87pf-7x99-5xc4 Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headers |
Medium | >= 3.3.0-beta1, < 3.3.0 | 3.3.0 |
| GHSA-87pf-7x99-5xc4 Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headers |
Medium | >= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-87pf-7x99-5xc4 Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headers |
Medium | < 3.1.17 | 3.1.17 |
| GHSA-2hpc-mf4q-j885 Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter |
Medium | >= 3.3.0-beta1, < 3.3.0 | 3.3.0 |
| GHSA-2hpc-mf4q-j885 Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter |
Medium | >= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-2hpc-mf4q-j885 Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter |
Medium | < 3.1.17 | 3.1.17 |
| GHSA-x5w2-wcr8-9q45 Silverstripe Missing security check on dev/build/defaults |
Medium | < 3.1.17 | 3.1.17 |
| GHSA-x5w2-wcr8-9q45 Silverstripe Missing security check on dev/build/defaults |
Medium | >= 3.3.0-beta1, < 3.3.0 | 3.3.0 |
| GHSA-x5w2-wcr8-9q45 Silverstripe Missing security check on dev/build/defaults |
Medium | >= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-qp29-wcc2-vmpc Silverstripe HtmlEditor embed url sanitisation |
Medium | >= 3.0.0, < 3.2.1 | 3.2.1 |
| GHSA-j982-5jv7-v43r Silverstripe Form field validation message XSS vulnerability |
Medium | >= 3.0.0, < 3.1.16 | 3.1.16 |
| GHSA-j982-5jv7-v43r Silverstripe Form field validation message XSS vulnerability |
Medium | >= 3.2.0, < 3.2.1 | 3.2.1 |
| GHSA-mqf5-275h-gf6r Silverstripe framework is vulnerable to XSS in install.php |
Medium | >= 3.1.0, < 3.1.14 | 3.1.14 |
| GHSA-g4hp-pfvf-vm5w SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation |
Medium | >= 3.0.0, < 3.0.14 | 3.0.14 |
| GHSA-g4hp-pfvf-vm5w SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation |
Medium | >= 3.1.0, < 3.1.13 | 3.1.13 |
| GHSA-hq4p-5mpr-jj9m Silverstripe XSS in dev/build returnURL Parameter |
Medium | < 3.1.14 | 3.1.14 |
| GHSA-vp8p-c6xj-xpj7 Silverstripe External redirection risk in Security?ReturnURL |
Medium | >= 3.1.0, < 3.1.13 | 3.1.13 |
| GHSA-vp8p-c6xj-xpj7 Silverstripe External redirection risk in Security?ReturnURL |
Medium | < 3.0.14 | 3.0.14 |
| GHSA-25gq-jvx2-vg9x Silverstripe X-Forwarded-Host request hostname injection |
High | >= 3.1.0, < 3.1.13 | 3.1.13 |
| GHSA-jqp8-v74p-g8px Silverstripe XSS in Director::force_redirect() |
Medium | >= 3.1.0, < 3.1.12 | 3.1.12 |
| GHSA-4h54-vwx9-3vr3 Silverstripe XSS In FormAction |
Medium | >= 3.1.0, < 3.1.10 | 3.1.10 |
| GHSA-34q6-xqxh-gq39 Silverstripe XSS In rewritten hash links |
Medium | < 3.0.13 | 3.0.13 |
| GHSA-34q6-xqxh-gq39 Silverstripe XSS In rewritten hash links |
Medium | >= 3.1.0, < 3.1.12 | 3.1.12 |
| GHSA-88jp-9jrv-6368 Silverstripe XSS In GridField print |
Medium | >= 3.1.0, < 3.1.10 | 3.1.10 |
| GHSA-r32j-mr8p-hfp8 Silverstripe XSS in TreeDropdownField and TreeMultiSelectField |
Medium | >= 3.1.0, < 3.1.10 | 3.1.10 |
| GHSA-g43w-98wp-m694 SilverStripe framework XML Quadratic Blowup Attack |
Medium | < 3.1.12 | 3.1.12 |
| GHSA-5f5v-5c3v-gw5v Silverstripe IE requests not properly behaving with rewritehashlinks |
Medium | < 3.0.13 | 3.0.13 |
| GHSA-5f5v-5c3v-gw5v Silverstripe IE requests not properly behaving with rewritehashlinks |
Medium | >= 3.1.0, < 3.1.12 | 3.1.12 |
| GHSA-qm2j-qvq3-j29v Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter |
Medium EPSS 0.36% |
>= 5.0.0, < 5.1.11 | 5.1.11 |
| GHSA-qm2j-qvq3-j29v Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter |
Medium EPSS 0.36% |
< 4.13.39 | 4.13.39 |
| GHSA-36xx-7vf6-7mv3 Silverstripe Framework: Members with no password can be created and bypass custom login forms |
Low | >= 3.0.0, < 4.13.14 | 4.13.14 |
| GHSA-36xx-7vf6-7mv3 Silverstripe Framework: Members with no password can be created and bypass custom login forms |
Low | >= 5.0.0, < 5.0.13 | 5.0.13 |
| GHSA-fw84-xgm8-9jmv Open redirect vulnerability on CMSSecurity relogin screen |
Medium EPSS 0.42% |
< 4.12.5 | 4.12.5 |
| GHSA-jh3w-6jp2-vqqm Missing permission check of canView in GridFieldPrintButton |
Medium EPSS 0.49% |
< 4.12.5 | 4.12.5 |
| GHSA-rr8h-f97q-8p9c Blind SQL Injection via GridFieldSortableHeader |
High EPSS 0.80% |
>= 4.11.0, < 4.11.14 | 4.11.14 |
| GHSA-rr8h-f97q-8p9c Blind SQL Injection via GridFieldSortableHeader |
High EPSS 0.80% |
>= 4.0.0, < 4.10.11 | 4.10.11 |
| GHSA-vvxf-r4vm-2vm6 Reflected XSS in querystring parameters |
Medium EPSS 0.52% |
>= 4.0.0, < 4.11.13 | 4.11.13 |
| GHSA-wc6r-4ggc-79w5 Stored XSS using HTMLEditor |
Medium EPSS 0.52% |
>= 4.0.0, < 4.11.13 | 4.11.13 |
| GHSA-qw4w-vq8v-2wcv Stored XSS using uppercase characters in HTMLEditor |
Medium EPSS 0.57% |
>= 4.0.0, < 4.11.13 | 4.11.13 |
| GHSA-9cx2-hj6m-fv58 Silverstripe XSS in shortcodes |
Medium EPSS 0.71% |
>= 4.0.0, < 4.11.13 | 4.11.13 |
| GHSA-9fmg-89fx-r33w Quadratic blowup in Convert::xml2array() |
Medium EPSS 1.09% |
>= 4.0.0, < 4.10.9 | 4.10.9 |
| GHSA-jx34-gqqq-r6gm Stored XSS via HTML fields in SilverStripe Framework |
Medium EPSS 0.71% |
>= 4.0.0, < 4.10.9 | 4.10.9 |
| GHSA-rppc-655v-7j3c Stored XSS in link tags added via XHR in SilverStripe Framework |
Medium EPSS 0.54% |
>= 4.0.0, < 4.10.9 | 4.10.9 |
| GHSA-3vjc-5x79-m9r8 SilverStripe XXE Vulnerability in CSSContentParser |
Medium EPSS 0.82% |
>= 4.0.0, < 4.7.4 | 4.7.4 |
| GHSA-2pw2-qpcp-m47x Silverstripe CMS XSS Vulnerability |
Medium EPSS 0.56% |
>= 3.0.0, < 3.7.5 | 3.7.5 |
| GHSA-gm5x-hpmw-xpxg Silverstripe CMS information disclosure |
High EPSS 1.80% |
>= 4.5.0, < 4.5.4 | 4.5.4 |
| GHSA-gm5x-hpmw-xpxg Silverstripe CMS information disclosure |
High EPSS 1.80% |
>= 4.0.0, < 4.4.7 | 4.4.7 |
| GHSA-q9ff-3q93-fm8m SilverStripe Web Cache Poisoning through HTTPRequestBuilder |
Medium EPSS 0.76% |
>= 4.0.0, < 4.4.7 | 4.4.7 |
| GHSA-q9ff-3q93-fm8m SilverStripe Web Cache Poisoning through HTTPRequestBuilder |
Medium EPSS 0.76% |
>= 3.0.0, < 3.7.5 | 3.7.5 |
| GHSA-q9ff-3q93-fm8m SilverStripe Web Cache Poisoning through HTTPRequestBuilder |
Medium EPSS 0.76% |
>= 4.5.0, < 4.5.4 | 4.5.4 |
| GHSA-592m-4533-rxq9 SilverStripe Folders migrated from 3.x may be unsafe to upload to |
High EPSS 1.73% |
>= 4.0.0, < 4.4.6 | 4.4.6 |
| GHSA-5fr8-xhqq-4p3q SilverStripe Denial of Service on flush and development URL tools |
Medium EPSS 0.70% |
>= 4.0.0, < 4.4.0 | 4.4.0 |
| GHSA-5fr8-xhqq-4p3q SilverStripe Denial of Service on flush and development URL tools |
Medium EPSS 0.70% |
<= 3.6 | No fix yet |
| GHSA-jgw2-f5mx-rg7h SilverStripe asset-admin Cross-site Scripting (XSS) |
Medium EPSS 0.73% |
>= 4.0.0, < 4.3.5 | 4.3.5 |
| GHSA-jgw2-f5mx-rg7h SilverStripe asset-admin Cross-site Scripting (XSS) |
Medium EPSS 0.73% |
>= 4.4.0, < 4.4.4 | 4.4.4 |
| GHSA-rfvw-5848-gxc5 Silverstripe Flash Clipboard Reflected XSS |
Medium EPSS 0.88% |
>= 3.0.0, < 4.3.5 | 4.3.5 |
| GHSA-rfvw-5848-gxc5 Silverstripe Flash Clipboard Reflected XSS |
Medium EPSS 0.88% |
>= 4.4.0-rc1, < 4.4.4 | 4.4.4 |
| GHSA-v358-rvxr-wffx Silverstripe XSS Vulnerabilities |
Medium EPSS 1.93% |
>= 2.4, < 2.4.7 | 2.4.7 |
| GHSA-v358-rvxr-wffx Silverstripe XSS Vulnerabilities |
Medium EPSS 1.93% |
>= 2.3, < 2.3.13 | 2.3.13 |
| GHSA-2jvj-mhf2-g99w SilverStripe CSV Excel Macro Injection |
Medium EPSS 0.90% |
< 3.5.6 | 3.5.6 |
| GHSA-2jvj-mhf2-g99w SilverStripe CSV Excel Macro Injection |
Medium EPSS 0.90% |
>= 4.0.0, < 4.0.1 | 4.0.1 |
| GHSA-2jvj-mhf2-g99w SilverStripe CSV Excel Macro Injection |
Medium EPSS 0.90% |
>= 3.6.0, < 3.6.3 | 3.6.3 |
| GHSA-fh35-p8ph-p545 Silverstripe CMS Open Redirect |
Medium EPSS 2.01% |
<= 3.1.13 | No fix yet |
| GHSA-wg4m-vvp6-2hc5 SilverStripe vulnerable to Cross-site Scripting |
Low EPSS 2.60% |
< 2.3.5 | 2.3.5 |
| GHSA-wvfw-w3x6-g526 Silverstripe Framework SQLi Vulnerability |
Critical EPSS 1.56% |
>= 4.2.0, < 4.2.4 | 4.2.4 |
| GHSA-wvfw-w3x6-g526 Silverstripe Framework SQLi Vulnerability |
Critical EPSS 1.56% |
>= 4.3.0, < 4.3.1 | 4.3.1 |
| GHSA-wvfw-w3x6-g526 Silverstripe Framework SQLi Vulnerability |
Critical EPSS 1.56% |
>= 4.1.0, < 4.1.5 | 4.1.5 |
| GHSA-wvfw-w3x6-g526 Silverstripe Framework SQLi Vulnerability |
Critical EPSS 1.56% |
>= 4.0.0, < 4.0.7 | 4.0.7 |
| GHSA-wvfw-w3x6-g526 Silverstripe Framework SQLi Vulnerability |
Critical EPSS 1.56% |
>= 3.7.0, < 3.7.3 | 3.7.3 |
| GHSA-wvfw-w3x6-g526 Silverstripe Framework SQLi Vulnerability |
Critical EPSS 1.56% |
>= 3.0.0, < 3.6.7 | 3.6.7 |
| GHSA-7mv4-4xpg-xq44 FormField with square brackets in field name skips validation |
Medium EPSS 1.34% |
>= 3.0.0, < 4.7.4 | 4.7.4 |
| GHSA-32m2-9f76-4gv8 Business Logic Errors in SilverStripe Framework |
Medium | < 4.10.1 | 4.10.1 |
| GHSA-43jj-2rwc-2m3f Broken access control on files |
Medium EPSS 1.11% |
>= 4.0.0, < 4.3.5 | 4.3.5 |
| GHSA-43jj-2rwc-2m3f Broken access control on files |
Medium EPSS 1.11% |
>= 4.4.0, < 4.4.4 | 4.4.4 |
| GHSA-qvrv-2x7x-78x2 Reflected XSS in SilverStripe |
Medium EPSS 0.69% |
>= 4.5.0, < 4.5.2 | 4.5.2 |
| GHSA-qvrv-2x7x-78x2 Reflected XSS in SilverStripe |
Medium EPSS 0.69% |
>= 4.0.0, < 4.4.5 | 4.4.5 |
| GHSA-6r58-4xgr-gm6m SilverStripe Priviledge escalation through cache pollution |
Low EPSS 0.85% |
>= 4.3.0, < 4.3.5 | 4.3.5 |
| GHSA-6r58-4xgr-gm6m SilverStripe Priviledge escalation through cache pollution |
Low EPSS 0.85% |
>= 4.4.0, < 4.4.4 | 4.4.4 |
| GHSA-jvx5-rm6q-gx7p Lack of access control on upoaded files |
Medium EPSS 1.37% |
>= 4.4.0, < 4.4.4 | 4.4.4 |
| GHSA-jvx5-rm6q-gx7p Lack of access control on upoaded files |
Medium EPSS 1.37% |
>= 3.7.0, < 3.7.4 | 3.7.4 |
| GHSA-jvx5-rm6q-gx7p Lack of access control on upoaded files |
Medium EPSS 1.37% |
< 3.6.8 | 3.6.8 |
| GHSA-jvx5-rm6q-gx7p Lack of access control on upoaded files |
Medium EPSS 1.37% |
>= 4.0.0, < 4.3.6 | 4.3.6 |
| GHSA-w7r7-r8r9-vrg2 Session fixation in change password form |
Medium EPSS 0.38% |
>= 4.0.0, < 4.3.5 | 4.3.5 |
| GHSA-w7r7-r8r9-vrg2 Session fixation in change password form |
Medium EPSS 0.38% |
>= 3.6.0, < 3.6.8 | 3.6.8 |
| GHSA-w7r7-r8r9-vrg2 Session fixation in change password form |
Medium EPSS 0.38% |
>= 3.7.0, < 3.7.4 | 3.7.4 |
| GHSA-w7r7-r8r9-vrg2 Session fixation in change password form |
Medium EPSS 0.38% |
>= 4.4.0, < 4.4.4 | 4.4.4 |
| GHSA-cg8j-8w52-735v Missing warning can lead to unauthenticated admin access in SilverStripe |
Critical EPSS 1.46% |
>= 4.1.0, < 4.3.5 | 4.3.5 |
| GHSA-xm6j-x342-gwq9 SilverStripe Versioned Files module Unpublished files are exposed publicly |
Medium EPSS 1.20% |
>= 4.4.0, < 4.4.4 | 4.4.4 |
| GHSA-xm6j-x342-gwq9 SilverStripe Versioned Files module Unpublished files are exposed publicly |
Medium EPSS 1.20% |
>= 4.0.0, < 4.3.5 | 4.3.5 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor