Every CVE Search/ Get API key

CVE-2011-1948

Cross-site scripting in Products.CMFPlone and Products.PasswordResetTool

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Exploit likelihood

2.40%Up 1.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Record
CVE-2011-1948
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Record
CVE-2011-1948
Updated
2026-11-02
EUVDEUVD-2011-0019 No score

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Record
EUVD-2011-0019
Updated
2026-11-03
GitHub AdvisoriesGHSA-p7h9-vf92-5fj5 5.3

Cross-site scripting in Products.CMFPlone and Products.PasswordResetTool

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Record
GHSA-p7h9-vf92-5fj5
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-p7h9-vf92-5fj5 5.3

Cross-site scripting in Products.CMFPlone and Products.PasswordResetTool

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Record
GHSA-p7h9-vf92-5fj5
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2026-2965 5.3

Cross-site scripting in Products.CMFPlone and Products.PasswordResetTool

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Record
PYSEC-2026-2965
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVPYSEC-2026-2966 5.3

Cross-site scripting in Products.CMFPlone and Products.PasswordResetTool

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Record
PYSEC-2026-2966
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVPYSEC-2011-14 No score

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Record
PYSEC-2011-14
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
products-passwordresettool
PyPI
 before 2.0.6
2.0.6
products-cmfplone
PyPI
 before 4.0.7
4.0.7
products-cmfplone
PyPI
 4.1a1 to 4.1rc2
4.1rc3
plone
PyPI
 before 4.1.1
4.1.1
products-passwordresettool
PyPI
 before 2.0.6, plus listed versions
1.11.21.31.42.0
Show 13 moreShow less
2.0.12.0.22.0.32.0.42.0.52.0a12.0b12.0b22.0b32.0b42.0b52.0b62.0b7
2.0.6
products-cmfplone
PyPI
 before 4.0.7, plus listed versions
4.0b1
4.0.7
products-cmfplone
PyPI
 4.1a1 up to 4.1rc3, plus listed versions
4.1a24.1a34.1b14.1b24.1rc2
4.1rc3
plone
PyPI
 before 4.1.1, plus listed versions
3.23.2.13.2.23.2.33.2a1
Show 44 moreShow less
3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1a14.1a24.1a34.1b14.1b24.1rc24.1rc3
4.1.1
products-cmfplone
PyPI
 before 4.0.7, 4.1a1 up to 4.1rc3, plus listed versions
4.0b14.1a24.1a34.1b14.1b24.1rc2
4.0.74.1rc3
conga
Red Hat:rhel_cluster:5
From an advisory covering 2 CVEs
 before 0:0.12.2-51.el5
0:0.12.2-51.el5
conga-debuginfo
Red Hat:rhel_cluster:5
From an advisory covering 2 CVEs
 before 0:0.12.2-51.el5
0:0.12.2-51.el5
luci
Red Hat:rhel_cluster:5
From an advisory covering 2 CVEs
 before 0:0.12.2-51.el5
0:0.12.2-51.el5
ricci
Red Hat:rhel_cluster:5
From an advisory covering 2 CVEs
 before 0:0.12.2-51.el5
0:0.12.2-51.el5

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-1948 is a medium vulnerability (CVSS 4.3) in Plone, published June 6, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. Fixed in products-passwordresettool 2.0.6.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open