Silverstripe vulnerabilities

Products

• Silverstripe 64
• Framework 15
• Silverstripe-framework 7
• Graphql 3
• Silverstripe-graphql 3
• Assets 2

Newest

• silverstripe silverstripe-mfa Silverstripe MFA: Can bypass MFA during password reset flow CVE-2026-55186 Fix available 4.2 MediumOctober 29, 2026
• silverstripe silverstripe-versioned Silverstripe Versioned: XSS in archive admin restore CVE-2026-55779 Fix available 5.4 MediumAugust 28, 2026
• silverstripe silverstripe-advancedworkflow Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template CVE-2026-54718 Fix available 7.2 HighAugust 27, 2026
• silverstripe silverstripe-userforms Silverstripe UserForms: Remote code execution via userforms email subject CVE-2026-54721 Fix available 8.8 HighAugust 27, 2026
• silverstripe silverstripe-cms Silverstripe: XSS in breadcrumbs in page list view CVE-2026-54717 Fix available 5.4 MediumAugust 6, 2026
• silverstripe silverstripe-framework Silverstripe Framework: Possible XSS attack through media embed CVE-2026-54720 Fix available 5.4 MediumJuly 1, 2026
• silverstripe silverstripe-assets Silverstripe Assets Module has a DBFile::getURL() permission bypass CVE-2026-24749 Fix available 5.3 MediumApril 16, 2026
• silverstripe framework, silverstripe-framework +1 more Silverstripe Framework has a XSS vulnerability in HTML editor CVE-2025-30148 Fix available 5.4 MediumApril 10, 2025
• silverstripe silverstripe-elemental Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports CVE-2025-25197 Fix available 5.4 MediumApril 10, 2025
• silverstripe framework, silverstripe-framework +1 more Cross-site Scripting in form messages in silverstripe framework CVE-2024-53277 Fix available 5.4 MediumJanuary 14, 2025
• silverstripe silverstripe-asset-admin Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin CVE-2024-47605 Public exploitFix available 5.4 MediumJanuary 14, 2025
• silverstripe framework, silverstripe-framework +1 more Cross-site Scripting vulnerability with encoded payload in silverstripe/framework CVE-2024-32981 Fix available 5.4 MediumJuly 17, 2024
• silverstripe reports, silverstripe-reports +1 more Reports are still accessible even when `canView()` returns false in silverstripe/reports CVE-2024-29885 Fix available 4.3 MediumJuly 17, 2024
• silverstripe admin, silverstripe-admin +1 more No permission checks for editing/deleting records with CSV import form CVE-2023-49783 Fix available 4.3 MediumJanuary 23, 2024
• silverstripe framework, silverstripe-framework +1 more Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter CVE-2023-48714 Fix available 4.3 MediumJanuary 23, 2024
• silverstripe graphql, silverstripe-graphql +1 more Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data CVE-2023-44401 Fix available 5.3 MediumJanuary 23, 2024
• silverstripe graphql, silverstripe-graphql +1 more Denial of service vulnerability in silverstripe-graphql via recursive queries CVE-2023-40180 Fix available 7.5 HighOctober 16, 2023
• silverstripe framework, silverstripe-framework +1 more Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen CVE-2023-22729 Fix available 5.4 MediumApril 26, 2023
• silverstripe framework, silverstripe-framework +1 more Silverstripe Framework has missing permission check of canView in GridFieldPrintButton CVE-2023-22728 Fix available 4.3 MediumApril 26, 2023
• silverstripe graphql, silverstripe-graphql +1 more silverstripe/graphql Denial of Service vulnerability CVE-2023-28104 Fix available 7.5 HighMarch 16, 2023
• silverstripe subsites SilverStripe Subsite weakens file permissions CVE-2022-42949 Fix available 7.5 HighDecember 19, 2022
• silverstripe framework Stored XSS in Compare Mode CVE-2022-38145 Fix available 5.4 MediumNovember 22, 2022
• silverstripe framework Reflected XSS in querystring parameters CVE-2022-38462 Fix available 6.1 MediumNovember 21, 2022
• silverstripe framework Stored XSS using HTMLEditor CVE-2022-37429 Fix available 5.4 MediumNovember 21, 2022
• silverstripe framework Stored XSS using uppercase characters in HTMLEditor CVE-2022-37430 Fix available 5.4 MediumNovember 21, 2022
• silverstripe Silverstipe CMS Stored XSS in custom meta tags CVE-2022-37421 Fix available 5.4 MediumNovember 21, 2022
• silverstripe assets, framework, asset admin +2 more Silverstripe XSS in shortcodes CVE-2022-38724 Fix available 5.4 MediumNovember 21, 2022
• silverstripe framework XSS via uploaded gpx file CVE-2022-38147 Fix available 5.4 MediumNovember 21, 2022
• silverstripe framework Blind SQL Injection via GridFieldSortableHeader CVE-2022-38148 Fix available 8.8 HighNovember 21, 2022
• silverstripe framework URL XSS vulnerability due to outdated jquery in CMS CVE-2022-38146 Fix available 5.4 MediumNovember 21, 2022
• silverstripe Stored XSS in link tags added via XHR in SilverStripe Framework CVE-2022-28803 Fix available 5.4 MediumJune 29, 2022
• silverstripe framework Stored XSS via HTML fields in SilverStripe Framework CVE-2022-25238 Fix available 5.4 MediumJune 28, 2022
• silverstripe assets Unpublished, protected files can be published via shortcode CVE-2022-29858 Fix available 4.3 MediumJune 28, 2022
• silverstripe Hybridsessions does not expire session id on logout CVE-2022-24444 Fix available 6.5 MediumJune 28, 2022
• silverstripe Quadratic blowup in Convert::xml2array() CVE-2021-41559 Fix available 6.5 MediumJune 28, 2022
• silverstripe silverstripe-omnipay Failed payment recorded has completed in silverstripe/silverstripe-omnipay CVE-2022-29254 Fix available 3.7 LowJune 6, 2022
• silverstripe SilverStripe GraphQL Server permission checker not inherited by query subclass. CVE-2021-28661 Fix available 4.3 MediumOctober 7, 2021
• silverstripe Cross-site Scripting in SilverStripe Framework CVE-2021-36150 Fix available 6.1 MediumOctober 7, 2021
• silverstripe Authentication bypass in SilverStripe GraphQL CVE-2020-26136 Fix available 6.5 MediumJune 8, 2021
• silverstripe SilverStripe XXE Vulnerability in CSSContentParser CVE-2020-25817 Fix available 4.8 MediumJune 8, 2021
• silverstripe FormField with square brackets in field name skips validation CVE-2020-26138 Fix available 5.3 MediumJune 8, 2021
• silverstripe Silverstripe CMS XSS Vulnerability CVE-2020-9311 Fix available 5.4 MediumJuly 15, 2020
• silverstripe mimevalidator, recipe +1 more Silverstripe CMS malicious file upload enables script execution CVE-2020-9309 8.8 HighJuly 15, 2020
• silverstripe Silverstripe CMS information disclosure CVE-2020-6164 Fix available 7.5 HighJuly 15, 2020
• silverstripe Silverstripe has Incorrect Default Permissions CVE-2020-6165 Fix available 5.3 MediumJuly 15, 2020
• silverstripe SilverStripe Web Cache Poisoning through HTTPRequestBuilder CVE-2019-19326 Fix available 5.9 MediumJuly 15, 2020
• silverstripe SilverStripe Folders migrated from 3.x may be unsafe to upload to CVE-2020-9280 Fix available 7.5 HighApril 15, 2020
• silverstripe SilverStripe Denial of Service on flush and development URL tools CVE-2019-12246 Fix available 4.3 MediumFebruary 19, 2020
• silverstripe Silverstripe CSRF Protection Bypass via GraphQL CVE-2019-12437 Fix available 8.8 HighFebruary 19, 2020
• silverstripe Reflected XSS in SilverStripe CVE-2019-19325 Fix available 6.1 MediumFebruary 17, 2020
• Show olderLoading…