PL
Product
Plone
103
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 3High 15Medium 30Low 0
Watch
Add Plone to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-7317 | 6.8 | Sep 25 | Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +27 more |
| CVE-2021-21336 | 6.5 | Mar 8 | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework Affected: 4.3.0 through 4.3.20; 5.0 through 5.2.4 |
| CVE-2017-1000483 | 6.5 | Jan 3 | Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1 Affected: 2.5.5; 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +34 more |
| CVE-2022-23599 | 6.1 | Jan 28 | Products.ATContentTypes are the core content types for Plone 2.1 - 4.3 Affected: before 3.0.6 |
| CVE-2021-33507 | 6.1 | May 21 | Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS Affected: through 4.3.20; 5.0 through 5.2.4 |
| CVE-2020-7936 | 6.1 | Jan 23 | An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly… Affected: 4.0.0 through 5.2.1 |
| CVE-2013-7062 | 6.1 | Jan 2 | Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through… Affected: 3.3.0 through 3.3.6; 4.0.0 through 4.0.9; 4.1.0 through 4.1.6; 4.2.0 through 4.2.7; 4.3.0 through 4.3.2 |
| CVE-2017-1000484 | 6.1 | Jan 3 | By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website Affected: 2.5.5; 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +34 more |
| CVE-2017-1000481 | 6.1 | Jan 3 | When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url Affected: 2.5.5; 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +34 more |
| CVE-2015-7316 | 6.1 | Sep 25 | Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1 Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7140 | 6.1 | Mar 7 | Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7139 | 6.1 | Mar 7 | Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7138 | 6.1 | Mar 7 | Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7137 | 6.1 | Mar 7 | Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7136 | 6.1 | Mar 7 | z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request Affected: 4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2016-7147 | 6.1 | Feb 4 | Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers… Affected: 2.5.5; 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +34 more |
| CVE-2015-7315 | 5.9 | Sep 25 | Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2021-35959 | 5.4 | Jun 30 | In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field Affected: 5.0 through 5.2.4 |
| CVE-2021-33513 | 5.4 | May 21 | Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool Affected: through 5.2.4 |
| CVE-2021-33512 | 5.4 | May 21 | Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document Affected: through 5.2.4 |
| CVE-2021-33508 | 5.4 | May 21 | Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item Affected: through 5.2.4 |
| CVE-2021-3313 | 5.4 | May 20 | Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality Affected: before 5.2.4 |
| CVE-2021-29002 | 5.4 | Mar 24 | A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter Affected: 5.2.3 |
| CVE-2020-7937 | 5.4 | Jan 23 | An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site Affected: 5.0 through 5.2.1 |
| CVE-2017-1000482 | 5.4 | Jan 3 | A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author… Affected: through 5.0.9; 5.1; 5.1; 5.1; 5.1; 5.1; +1 more |
| CVE-2016-4042 | 5.3 | Feb 24 | Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7135 | 4.9 | Mar 7 | Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a Affected: 4.2; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +26 more |
| CVE-2016-4043 | 4.9 | Feb 24 | Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates Affected: 5.0; 5.0; 5.0; 5.0; 5.0.1; 5.0.2; +3 more |
| CVE-2021-33510 | 4.3 | May 21 | Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file Affected: through 5.2.4 |
| CVE-2017-5524 | 4.3 | Mar 23 | Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string… Affected: 4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
Showing 30