Silverstripe Framework vulnerabilities

• silverstripe silverstripe-framework Silverstripe Framework: Possible XSS attack through media embed CVE-2026-54720 Fix available 5.4 MediumJuly 1, 2026
• silverstripe framework, silverstripe-framework +1 more Silverstripe Framework has a XSS vulnerability in HTML editor CVE-2025-30148 Fix available 5.4 MediumApril 10, 2025
• silverstripe framework, silverstripe-framework +1 more Cross-site Scripting in form messages in silverstripe framework CVE-2024-53277 Fix available 5.4 MediumJanuary 14, 2025
• silverstripe framework, silverstripe-framework +1 more Cross-site Scripting vulnerability with encoded payload in silverstripe/framework CVE-2024-32981 Fix available 5.4 MediumJuly 17, 2024
• silverstripe framework, silverstripe-framework +1 more Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter CVE-2023-48714 Fix available 4.3 MediumJanuary 23, 2024
• silverstripe framework, silverstripe-framework +1 more Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen CVE-2023-22729 Fix available 5.4 MediumApril 26, 2023
• silverstripe framework, silverstripe-framework +1 more Silverstripe Framework has missing permission check of canView in GridFieldPrintButton CVE-2023-22728 Fix available 4.3 MediumApril 26, 2023
• silverstripe framework Stored XSS in Compare Mode CVE-2022-38145 Fix available 5.4 MediumNovember 22, 2022
• silverstripe framework Reflected XSS in querystring parameters CVE-2022-38462 Fix available 6.1 MediumNovember 21, 2022
• silverstripe framework Stored XSS using HTMLEditor CVE-2022-37429 Fix available 5.4 MediumNovember 21, 2022
• silverstripe framework Stored XSS using uppercase characters in HTMLEditor CVE-2022-37430 Fix available 5.4 MediumNovember 21, 2022
• silverstripe assets, framework, asset admin +2 more Silverstripe XSS in shortcodes CVE-2022-38724 Fix available 5.4 MediumNovember 21, 2022
• silverstripe framework XSS via uploaded gpx file CVE-2022-38147 Fix available 5.4 MediumNovember 21, 2022
• silverstripe framework Blind SQL Injection via GridFieldSortableHeader CVE-2022-38148 Fix available 8.8 HighNovember 21, 2022
• silverstripe framework URL XSS vulnerability due to outdated jquery in CMS CVE-2022-38146 Fix available 5.4 MediumNovember 21, 2022
• silverstripe framework Stored XSS via HTML fields in SilverStripe Framework CVE-2022-25238 Fix available 5.4 MediumJune 28, 2022