PL
Vendor
Plone
127
CVEs
0
On KEV
0
New 30D
Products
PL9.9
Plone
Plone
103 CVEs0 on KEV0 new
PC–
Plone Cms
Plone
5 CVEs0 on KEV0 new
VO8.7
volto
plone
3 CVEs0 on KEV0 new
IS6.1
Isurlinportal
Plone
2 CVEs0 on KEV0 new
PL9.9
plone.app.portlets
plone
2 CVEs0 on KEV0 new
PD9.8
Plone Docker Official Image
Plone
2 CVEs0 on KEV0 new
CM–
Cmfeditions
Plone
1 CVEs0 on KEV0 new
NA5.4
Namedfile
Plone
1 CVEs0 on KEV0 new
PL6.5
plone.app.contenttypes
plone
1 CVEs0 on KEV0 new
PL6.5
plone.app.dexterity
plone
1 CVEs0 on KEV0 new
PL9.1
plone.app.event
plone
1 CVEs0 on KEV0 new
PL4.3
plone.app.textfield
plone
1 CVEs0 on KEV0 new
PH–
Plone Hotfix 20110720
Plone
1 CVEs0 on KEV0 new
PL–
Plonepas
Plone
1 CVEs0 on KEV0 new
PR6.1
Products.isurlinportal
plone
1 CVEs0 on KEV0 new
RE7.5
Rest
Plone
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-57576 | PL plone.app.contenttypes plone | 6.5 | Sep 22 | plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length |
| CVE-2026-57149 | PL plone.app.portlets plone | 9.9 | Sep 22 | plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection |
| CVE-2026-54503 | PL plone.app.textfield plone | 4.3 | Sep 15 | plone.app.textfield: Stored XSS by spoofing mime type |
| CVE-2026-55247 | PL plone.app.event plone | 9.1 | Aug 28 | plone.app.event: Denial of service via iCalendar import |
| CVE-2026-55248 | PL plone.app.portlets plone | 9.1 | Aug 28 | plone.app.portlets: Denial of service via RSS feed portlet |
| CVE-2026-28413 | PR Products.isurlinportal plone | 6.1 | Mar 5 | Products.isurlinportal: Possible open redirect when using more than 2 forward slashes |
| CVE-2025-61668 | VO volto plone | 8.7 | Oct 2 | @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user |
| CVE-2025-58047 | VO volto plone | 7.5 | Aug 28 | Volto affected by possible DoS by invoking specific URL by anonymous user |
| CVE-2024-22889 | PL Plone Plone | 7.5 | Mar 6 | Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request |
| CVE-2024-23756 | PL Plone Plone | 7.5 | Feb 8 | The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading… |
| CVE-2024-23054 | PD Plone Docker Official Image Plone | 9.8 | Feb 5 | An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not… |
| CVE-2024-23055 | PD Plone Docker Official Image Plone | 6.1 | Jan 25 | An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headers |
| CVE-2024-0669 | PL Plone Plone | 7.1 | Jan 18 | A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5 |
| CVE-2023-42457 | RE Rest Plone | 7.5 | Sep 21 | plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc |
| CVE-2023-41048 | NA Namedfile Plone | 5.4 | Sep 21 | plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content |
| CVE-2021-33926 | PL Plone Plone | 8.8 | Feb 17 | An issue in Plone CMS v |
| CVE-2022-24740 | VO Volto Plone | 7.5 | Mar 14 | Volto is a ReactJS-based frontend for the Plone Content Management System |
| CVE-2022-23599 | PL Plone Plone | 6.1 | Jan 28 | Products.ATContentTypes are the core content types for Plone 2.1 - 4.3 |
| CVE-2021-32806 | IS Isurlinportal Plone | 6.1 | Aug 2 | Products.isurlinportal is a replacement for isURLInPortal method in Plone |
| CVE-2021-35959 | PL Plone Plone | 5.4 | Jun 30 | In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field |
| CVE-2021-33513 | PL Plone Plone | 5.4 | May 21 | Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool |
| CVE-2021-33512 | PL Plone Plone | 5.4 | May 21 | Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document |
| CVE-2021-33511 | PL Plone Plone | 7.5 | May 21 | Plone though 5.2.4 allows SSRF via the lxml parser |
| CVE-2021-33510 | PL Plone Plone | 4.3 | May 21 | Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file |
| CVE-2021-33509 | PL Plone Plone | 9.9 | May 21 | Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script |
| CVE-2021-33508 | PL Plone Plone | 5.4 | May 21 | Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item |
| CVE-2021-33507 | PL Plone Plone | 6.1 | May 21 | Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS |
| CVE-2021-32633 | PL Plone Plone | 8.8 | May 21 | Zope is an open-source web application server |
| CVE-2021-3313 | PL Plone Plone | 5.4 | May 20 | Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality |
| CVE-2021-29002 | PL Plone Plone | 5.4 | Mar 24 | A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter |
| CVE-2021-21336 | PL Plone Plone | 6.5 | Mar 8 | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework |
| CVE-2020-28736 | PL Plone Plone | 8.8 | Dec 30 | Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager… |
| CVE-2020-28735 | PL Plone Plone | 8.8 | Dec 30 | Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role) |
| CVE-2020-28734 | PL Plone Plone | 8.8 | Dec 30 | Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role |
| CVE-2020-35190 | PL Plone Plone | 9.8 | Dec 17 | The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user |
| CVE-2020-7941 | PL Plone Plone | 9.8 | Jan 23 | A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission |
| CVE-2020-7940 | PL Plone Plone | 7.5 | Jan 23 | Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking |
| CVE-2020-7939 | PL Plone Plone | 8.8 | Jan 23 | SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries |
| CVE-2020-7938 | PL Plone Plone | 8.8 | Jan 23 | plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level |
| CVE-2020-7937 | PL Plone Plone | 5.4 | Jan 23 | An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site |
| CVE-2020-7936 | PL Plone Plone | 6.1 | Jan 23 | An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly… |
| CVE-2013-7062 | PL Plone Plone | 6.1 | Jan 2 | Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through… |
| CVE-2017-1000484 | PL Plone Plone | 6.1 | Jan 3 | By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website |
| CVE-2017-1000483 | PL Plone Plone | 6.5 | Jan 3 | Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1 |
| CVE-2017-1000482 | PL Plone Plone | 5.4 | Jan 3 | A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author… |
| CVE-2017-1000481 | PL Plone Plone | 6.1 | Jan 3 | When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url |
| CVE-2015-7293 | PL Plone Plone | 8.8 | Sep 25 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x |
| CVE-2015-7318 | PL Plone Plone | 7.5 | Sep 25 | Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses |
| CVE-2015-7317 | PL Plone Plone | 6.8 | Sep 25 | Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings |
| CVE-2015-7316 | PL Plone Plone | 6.1 | Sep 25 | Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1 |
| CVE-2015-7315 | PL Plone Plone | 5.9 | Sep 25 | Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone… |
| CVE-2017-5524 | PL Plone Plone | 4.3 | Mar 23 | Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string… |
| CVE-2016-7140 | PL Plone Plone | 6.1 | Mar 7 | Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to… |
| CVE-2016-7139 | PL Plone Plone | 6.1 | Mar 7 | Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to… |
| CVE-2016-7138 | PL Plone Plone | 6.1 | Mar 7 | Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to… |
| CVE-2016-7137 | PL Plone Plone | 6.1 | Mar 7 | Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites… |
| CVE-2016-7136 | PL Plone Plone | 6.1 | Mar 7 | z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request |
| CVE-2016-7135 | PL Plone Plone | 4.9 | Mar 7 | Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a |
| CVE-2016-4043 | PL Plone Plone | 4.9 | Feb 24 | Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates |
| CVE-2016-4042 | PL Plone Plone | 5.3 | Feb 24 | Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors |