Silverstripe/cms
15 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Silverstripe/cms, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Silverstripe/cms CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 15 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High2
- Medium9
Latest CVEs
The 15 most recently published vulnerabilities affecting Silverstripe/cms.
- GHSA-3mm9-2p44-rw39Silverstripe SiteTree Creation Permission Vulnerability—
- GHSA-r97r-64vp-fghmSilverstripe XSS vulnerability via VirtualPage—
- GHSA-6hh6-59j2-qrxwSilverstripe History XSS Vulnerability—
- CVE-2022-37421Silverstripe silverstripe/cms through 4.11.0 allows XSS.5.4
- CVE-2020-9311In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted l...5.4
- CVE-2020-9309Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions (for example HTML code in a TXT file). When these files are stored a...8.8
- CVE-2020-6164In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe applicati...7.5
- CVE-2019-12204In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.9.8
- CVE-2017-12849Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.5.3
- CVE-2017-14498SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/p...6.1
- CVE-2017-5197There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element.6.1
- CVE-2015-8606Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Lo...6.1
- CVE-2015-5062Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter...5.8
- CVE-2011-4962code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not ...6.8
- CVE-2010-1593Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm,...4.3
Product grouping is registry-driven, with AI assist and human review. How it works