Read the docs

apostrophecms

Records66All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

apostrophecms records in CISA KEV

No apostrophecms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Apostrophecms 9 records HIGH Sanitize-html 8 records MEDIUM Import-export 1 record HIGH

Records

8 records in Sanitize-html · all components

TI-2024-14258 CVE-2024-21501 · GHSA-rm97-x556-q36h

Information disclosure in sanitize-html

Priority MEDIUM 63

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dep…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01027 Published 2024-02-24 Partial fix · 2.12.1 CWE-200
TI-2019-15279 CVE-2019-25225 · GHSA-qhxp-v273-g94h

Cross-site scripting in sanitize-html

Priority MEDIUM 60

`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00269 Published 2025-09-08 Fixed in 2.0.0-beta CWE-79
TI-2014-08427 CVE-2014-125128 · GHSA-389w-f784-rjg3

Cross-site scripting in sanitize-html

Priority MEDIUM 60

'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00274 Published 2025-09-08 Fixed in 1.0.3 CWE-79
TI-2022-09444 CVE-2022-25887 · GHSA-cgfm-xwp7-2cvr

Regular expression denial of service (ReDoS) in sanitize-html

Priority LOW 36

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01551 Published 2022-08-30 Partial fix · 2.7.1 CWE-1333
TI-2016-09355 CVE-2016-1000237 · GHSA-3j7m-hmh3-9jmp

sanitize-html before 1.4.3 has XSS.

Priority LOW 29

sanitize-html before 1.4.3 has XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0084 Published 2020-01-23 Fixed in 1.4.3 CWE-79
TI-2021-08273 CVE-2021-26540 · GHSA-mjxr-4v3x-q3m4

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the…

Priority LOW 28

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass h…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01775 Published 2021-02-08 Partial fix · 2.3.2 CWE-20
TI-2021-08272 CVE-2021-26539 · GHSA-rjqq-98f6-6j3r

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle…

Priority LOW 28

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" op…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01977 Published 2021-02-08 Partial fix · 2.3.1 CWE-20
Open these records in search →