Security advisories

medium2026-08-27

Silverstripe Framework: Possible XSS attack through media embed

GHSA-gvrw-qqp5-jgc5 · CVE-2026-54720

medium2025-04-10

Silverstripe Framework user enumeration via timing attack on login and password reset forms

GHSA-256q-hx8w-xcqx

medium2025-04-10

Silverstripe Framework has a XSS vulnerability in HTML editor

GHSA-rhx4-hvx9-j387 · CVE-2025-30148

low2025-01-23

Reflected Cross Site Scripting (XSS) in error message

GHSA-74j9-xhqr-6qv3

low2025-01-14

Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message

GHSA-mqf3-qpc3-g26q

medium2025-01-14

Silverstripe Framework has a XSS in form messages

GHSA-ff6q-3c9c-6cf5 · CVE-2024-53277

medium2025-01-14

Silverstripe Framework has a XSS via insert media remote file oembed

GHSA-7cmp-cgg8-4c82 · CVE-2024-47605

medium2024-07-17

Silverstripe uses TinyMCE which allows svg files linked in object tags

GHSA-52cw-pvq9-9m5v

medium2024-07-17

Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload

GHSA-chx7-9x8h-r5mg · CVE-2024-32981

high2024-05-28

silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector

GHSA-265q-222x-52m6

high2024-05-28

silverstripe/framework has possible denial of service attack vector when flushing

GHSA-cwgq-83w5-8jfq

medium2024-05-28

silverstripe/framework may disclose database credentials during connection failure

GHSA-m2hh-2m46-x6j5

high2024-05-27

silverstripe/framework allows upload of dangerous file types

GHSA-vcg6-8fxc-x5cq

medium2024-05-27

silverstripe/framework vulnerable to member disclosure in login form

GHSA-crr3-h4m8-7f56

low2024-05-27

silverstripe/framework sends passwords back to browsers under some circumstances

GHSA-vh7q-j8p5-2h4h

medium2024-05-27

silverstripe/framework uploaded PHP script execution in assets

GHSA-f43j-8hq4-2xj9

high2024-05-27

silverstripe/framework code execution vulnerability

GHSA-vgxh-x8jv-hmff

high2024-05-27

silverstripe/framework BackURL validation bypass with malformed URLs

GHSA-m5q3-mvcr-gc5m

medium2024-05-27

silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms

GHSA-r3pr-fh25-wrfc

medium2024-05-27

silverstripe/framework Privilege Escalation Risk in Member Edit form

GHSA-xpff-c35g-j3cr