Plone vulnerabilities

Products

• Plone 103
• Cms 5
• Volto 3
• Isurlinportal 2
• Plone.app.portlets 2
• Docker Official Image 2
• Products.isurlinportal 2

Newest

• plone plone.app.contenttypes, plone.app.dexterity +1 more plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length CVE-2026-57576 Fix available 6.5 MediumSeptember 22, 2026
• plone plone.app.portlets plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection CVE-2026-57149 Fix available 9.9 CriticalSeptember 22, 2026
• plone plone.app.event plone.app.event: Denial of service via iCalendar import CVE-2026-55247 Fix available 9.1 CriticalAugust 28, 2026
• plone plone.app.portlets plone.app.portlets: Denial of service via RSS feed portlet CVE-2026-55248 Fix available 9.1 CriticalAugust 28, 2026
• plone plone.app.textfield plone.app.textfield: Stored XSS by spoofing mime type CVE-2026-54503 Fix available 4.3 MediumJuly 17, 2026
• plone isurlinportal, products.isurlinportal +1 more Products.isurlinportal: Possible open redirect when using more than 2 forward slashes CVE-2026-28413 Fix available 5.3 MediumMarch 2, 2026
• plone volto @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user CVE-2025-61668 Fix available 8.7 HighOctober 1, 2025
• plone volto Volto affected by possible DoS by invoking specific URL by anonymous user CVE-2025-58047 Fix available 7.5 HighAugust 28, 2025
• plone Phone information disclosure vulnerability CVE-2024-22889 Public exploit 7.5 HighMarch 5, 2024
• plone The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221),... CVE-2024-23756 7.5 HighFebruary 8, 2024
• plone docker official image An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for... CVE-2024-23054 9.8 CriticalFebruary 5, 2024
• plone docker official image An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code... CVE-2024-23055 6.1 MediumJanuary 25, 2024
• plone, plone cms cms +1 more Cross-Frame Scripting (XFS) on Plone CMS CVE-2024-0669 Fix available 6.3 MediumJanuary 18, 2024
• plone plone.rest, rest +1 more plone.rest vulnerable to Denial of Service when ++api++ is used many times CVE-2023-42457 Fix available 7.5 HighSeptember 21, 2023
• plone namedfile, plone.namedfile +1 more plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images CVE-2023-41048 Fix available 3.7 LowSeptember 21, 2023
• plone Server-Side Request Forgery in Plone CMS CVE-2021-33926 Fix available 8.8 HighFebruary 17, 2023
• plone volto Improper Authentication in Volto CVE-2022-24740 Fix available 5.0 MediumMarch 14, 2022
• plone Cross-site Scripting and Open Redirect in Products.ATContentTypes CVE-2022-23599 Fix available 4.3 MediumJanuary 28, 2022
• plone isurlinportal, products.isurlinportal +1 more URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal CVE-2021-32806 Fix available 6.5 MediumAugust 2, 2021
• plone Plone has stored XSS in folder contents CVE-2021-35959 Fix available 5.4 MediumJune 30, 2021
• plone, zope +1 more Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone CVE-2021-33507 Fix available 6.1 MediumMay 21, 2021
• plone Cross-site scripting in Plone CVE-2021-33508 Fix available 5.4 MediumMay 21, 2021
• plone Incorrect Permission Assignment for Critical Resource in Plone CVE-2021-33509 Fix available 9.9 CriticalMay 21, 2021
• plone Server-Side Request Forgery in Plone CVE-2021-33510 Fix available 4.3 MediumMay 21, 2021
• plone Server-Side Request Forgery in Plone CVE-2021-33511 Fix available 7.5 HighMay 21, 2021
• plone Cross-site scripting in Plone CVE-2021-33512 Fix available 5.4 MediumMay 21, 2021
• plone Cross-site scripting in Plone CVE-2021-33513 Fix available 5.4 MediumMay 21, 2021
• zope, plone +1 more Remote Code Execution via traversal in TAL expressions CVE-2021-32633 Fix available 6.8 MediumMay 21, 2021
• plone Plone XSS in User Fullname Property and File Upload CVE-2021-3313 Fix available 5.4 MediumMay 20, 2021
• plone Plone XSS Vulnerability CVE-2021-29002 5.4 MediumMarch 24, 2021
• zope products.pluggableauthservice, plone +1 more Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager CVE-2021-21336 Fix available 6.5 MediumMarch 8, 2021
• plone Improper Restriction of XML External Entity Reference in Plone CVE-2020-28736 Fix available 8.8 HighDecember 30, 2020
• plone SSRF attacks via tracebacks in Plone CVE-2020-28735 Fix available 8.8 HighDecember 30, 2020
• plone Improper Restriction of XML External Entity Reference in Plone CVE-2020-28734 Fix available 8.8 HighDecember 30, 2020
• plone The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a... CVE-2020-35190 9.8 CriticalDecember 17, 2020
• plone Plone Open Redirect Vulnerability CVE-2020-7936 Fix available 6.1 MediumJanuary 23, 2020
• plone Plone cross site scripting (XSS) CVE-2020-7937 Fix available 5.4 MediumJanuary 23, 2020
• plone Plone Privilege Escallation CVE-2020-7938 Fix available 8.8 HighJanuary 23, 2020
• plone Plone SQL Injection Vulnerability CVE-2020-7939 Fix available 8.8 HighJanuary 23, 2020
• plone Plone allows weak passwords CVE-2020-7940 Fix available 7.5 HighJanuary 23, 2020
• plone Plone Unauthenticated Write Vulnerability CVE-2020-7941 Fix available 9.8 CriticalJanuary 23, 2020
• plone Plone Zope cross-site scripting (XSS) vulnerability CVE-2013-7062 Fix available 6.1 MediumJanuary 2, 2020
• plone Plone Open Redirect CVE-2017-1000484 Fix available 6.1 MediumJanuary 3, 2018
• plone Plone Unauthorized Access Vulnerability CVE-2017-1000483 Fix available 6.5 MediumJanuary 3, 2018
• plone Products.CMFPlone XSS in profile home_page property CVE-2017-1000482 Fix available 5.4 MediumJanuary 3, 2018
• plone Products.CMFPlone Open Redirect Vulnerability CVE-2017-1000481 Fix available 6.1 MediumJanuary 3, 2018
• plone, zope management interface +1 more Plone vulnerable to cross-site request forgery CVE-2015-7293 Public exploitFix available 8.8 HighSeptember 25, 2017
• plone Plone Header Injection CVE-2015-7318 Fix available 7.5 HighSeptember 25, 2017
• kupu project kupu, plone +1 more Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7... CVE-2015-7317 6.8 MediumSeptember 25, 2017
• plone Plone Cross-site Scripting Vulnerability CVE-2015-7316 Fix available 6.1 MediumSeptember 25, 2017
• Show olderLoading…