Security advisories

medium2024-05-27

silverstripe/framework's URL parameters `isDev` and `isTest` unguarded

GHSA-55qg-6c4m-mw6g

high2024-05-27

silverstripe/framework SQL injection in full text search

GHSA-xx4r-5265-48j6

medium2024-05-27

silverstripe/framework users inadvertently passing sensitive data to LoginAttempt

GHSA-ph62-fv59-vf9h

high2024-05-27

silverstripe/framework CSV Excel Macro Injection

GHSA-mqjc-x563-c9q8

high2024-05-27

silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms

GHSA-7m2v-x7rg-5hm5

high2024-05-27

silverstripe/framework's User-Agent header not correctly invalidating user session

GHSA-4qx8-j9vh-2628

medium2024-05-27

silverstripe/framework has Cross-site Scripting vulnerability in page history comparison

GHSA-c4c3-j73v-634r

medium2024-05-27

silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage

GHSA-pp7q-6j3f-74vj

medium2024-05-27

silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL

GHSA-r85g-7jpv-8xrx

medium2024-05-27

silverstripe/framework has Cross-site Scripting vulnerability in page name

GHSA-hhvj-mcrx-3vcf

medium2024-05-27

silverstripe/framework member disclosure in login form

GHSA-g84q-cq55-xwgp

medium2024-05-27

silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField`

GHSA-468j-6jrc-2rjx

medium2024-05-27

silverstripe/framework's `Member.Name` is not escaped

GHSA-r9vp-fp72-xgf7

low2024-05-27

silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled

GHSA-5r8w-66hq-rc39

medium2024-05-27

silverstripe/framework missing ACL on reports

GHSA-52cx-hpc5-cxwc

medium2024-05-27

silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`

GHSA-p5h2-vr99-xm99

low2024-05-27

silverstripe/framework password encryption salt not updated

GHSA-f3wp-xpv2-6vmg

medium2024-05-23

silverstripe/framework ReadOnly transformation for formfields exploitable

GHSA-97jm-g33h-f46g

medium2024-05-23

Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

GHSA-mpqj-f4v3-334h

medium2024-05-23

Silverstripe Missing CSRF protection in login form

GHSA-vj2j-6g3w-4662