Sulu vulnerabilities

Products

• Sulu 17

Newest

• sulu Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) CVE-2026-92692 Fix available 6.9 MediumSeptember 23, 2026
• sulu Sulu: Stored XSS via media download inline-disposition override CVE-2026-82396 Fix available 5.4 MediumAugust 31, 2026
• sulu Sulu: Media move/update authorization bypass (IDOR) CVE-2026-82395 Fix available 5.3 MediumAugust 31, 2026
• sulu Sulu: Fix authorization bypass when creating preview links CVE-2026-82394 Fix available 5.3 MediumAugust 31, 2026
• sulu Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens CVE-2026-45701 Fix available 6.9 MediumMay 18, 2026
• sulu Sulu checks fix permissions for subentities endpoints CVE-2026-34372 Fix available 5.3 MediumMarch 30, 2026
• sulu Sulu vulnerable to XXE in SVG File upload Inspector CVE-2025-47778 Fix available 6.1 MediumMay 14, 2025
• sulu Reflected XSS Vulnerability in Sulu Media Bundle CVE-2024-47617 Fix available 6.1 MediumOctober 3, 2024
• sulu Sulu vulnerable to XSS via uploaded SVG CVE-2024-47618 Fix available 5.1 MediumOctober 3, 2024
• sulu suluformbundle TokenController formName not sanitized in hidden input CVE-2024-37156 Fix available 6.1 MediumJune 6, 2024
• sulu Sulu grants access to pages regardless of role permissions CVE-2024-27915 Fix available 6.8 MediumMarch 4, 2024
• sulu Sulu is vulnerable to HTML Injection via Autocomplete Suggestion CVE-2024-24807 Fix available 2.7 LowFebruary 5, 2024
• sulu Sulu Observable Response Discrepancy on Admin Login CVE-2023-39343 Fix available 4.3 MediumAugust 3, 2023
• sulu PHP file inclusion in the Sulu admin panel CVE-2021-43836 Fix available 8.5 HighDecember 15, 2021
• sulu Privilege escalation in the Sulu Admin panel CVE-2021-43835 Fix available 7.2 HighDecember 15, 2021
• sulu Improper Neutralization HTML tags in sulu/sulu CVE-2021-41169 Fix available 6.2 MediumOctober 21, 2021
• sulu XSS Injection in Media Collection Title was possible CVE-2021-32737 Fix available 8.4 HighJuly 2, 2021
• sulu Reset Password / Login vulnerability in Sulu CVE-2020-15132 Fix available 5.3 MediumAugust 5, 2020
• sulu sulu-standard Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within... CVE-2017-1000465 5.4 MediumJanuary 9, 2018