{"id":"CVE-2015-8606","aliases":["EUVD-2022-4014","GHSA-gvc8-xjfp-6569"],"status":"published","title":"Silverstripe CMS XSS Vulnerability","description":"Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS \u0026 Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01535,"percentile":0.75015,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-04-13T15:00:00Z","modified":"2026-06-17T00:34:50Z","fixes":[{"ecosystem":"Packagist","package":"silverstripe/cms","fixed_in":["3.1.16","3.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"silverstripe/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.15"},{"fixed":"3.1.16"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"silverstripe/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"last_affected":"3.2.0"},{"fixed":"3.2.1"}]}],"versions":["3.2.0"]},{"source":"osv","ecosystem":"Packagist","package":"silverstripe/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.16"}]}],"versions":["2.4.10","2.4.11","2.4.12","2.4.13","2.4.9","2.5.0","3.0.10","3.0.10-rc1","3.0.11","3.0.11-rc1","3.0.12","3.0.13","3.0.14","3.0.2.1","3.0.3","3.0.3-rc1","3.0.3-rc2","3.0.4","3.0.5","3.0.6","3.0.6-rc1","3.0.6-rc2","3.0.7","3.0.7-rc1","3.0.8","3.0.9","3.0.9-rc1","3.1.0","3.1.0-beta1","3.1.0-beta2","3.1.0-beta3","3.1.0-rc1","3.1.0-rc2","3.1.0-rc3","3.1.1","3.1.10","3.1.10-rc1","3.1.10-rc2","3.1.11","3.1.11-rc1","3.1.12","3.1.13","3.1.13-rc1","3.1.14","3.1.14-rc1","3.1.15","3.1.16-rc1","3.1.2","3.1.2-rc1","3.1.3","3.1.3-rc1","3.1.3-rc2","3.1.4","3.1.4-rc1","3.1.5","3.1.5-rc1","3.1.6","3.1.6-rc1","3.1.6-rc2","3.1.6-rc3","3.1.7","3.1.7-rc1","3.1.8","3.1.9","3.1.9-rc1"]},{"source":"osv","ecosystem":"Packagist","package":"silverstripe/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.1"}]}],"versions":["3.2.0","3.2.1-rc1","3.2.1-rc2"]}],"products":[{"vendor":"silverstripe","product":"silverstripe"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2015/12/17/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/12/17/11","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/12/18/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.silverstripe.org/download/security-releases/ss-2015-026","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2015/Dec/55","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"https://cybersecurityworks.com/zerodays/cve-2015-8606-silverstripe.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8606","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gvc8-xjfp-6569"},{"url":"https://github.com/silverstripe/silverstripe-cms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2015-8606","description":"Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS \u0026 Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.","status":"published","published":"2016-04-13T15:00:00Z","modified":"2024-08-06T08:20:43.475Z","updated_at":"2026-11-02T14:35:41.26549Z"}],"euvd":[{"id":"EUVD-2022-4014","description":"Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS \u0026 Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.","status":"published","published":"2016-04-13T15:00:00Z","modified":"2024-08-06T08:20:43Z","updated_at":"2026-11-03T01:57:26.384611Z"}],"ghsa":[{"id":"GHSA-gvc8-xjfp-6569","title":"Silverstripe CMS XSS Vulnerability","description":"Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS \u0026 Framework before 3.1.16 and 3.2.0 before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to `admin/security/EditForm/field/Members/item/new/ItemEditForm`.","status":"published","published":"2022-05-13T01:13:58Z","modified":"2023-12-07T19:45:58Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:24.593982Z"}],"nvd":[{"id":"CVE-2015-8606","description":"Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS \u0026 Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.","status":"published","published":"2016-04-13T15:59:09.743Z","modified":"2026-06-17T00:34:50.493Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"GHSA-gvc8-xjfp-6569","title":"Silverstripe CMS XSS Vulnerability","description":"Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS \u0026 Framework before 3.1.16 and 3.2.0 before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to `admin/security/EditForm/field/Members/item/new/ItemEditForm`.","status":"published","published":"2022-05-13T01:13:58Z","modified":"2024-02-16T08:18:02.222081Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}