Vendors / orchardcms Records 11 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 2
Exploited now orchardcms records in CISA KEV No orchardcms vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 73
In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.01058 · Published 2021-10-10 · No fix listed CWE-613
Priority MEDIUM 56
Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00473 · Published 2026-01-30 · No fix listed CWE-79
Priority MEDIUM 42
Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS).
CVSS 3.1 CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.00832 · Published 2022-11-25 · No fix listed CWE-79
Priority LOW 31
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media.
CVSS 4.0 HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00363 · Published 2026-10-30 · No fix listed CWE-863
Priority LOW 30
Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0074 · Published 2022-03-10 · Fixed in 1.3.0 CWE-285
Priority LOW 29
Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0074 · Published 2022-03-10 · Fixed in 1.3.0 CWE-79
Priority LOW 26
In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users…
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00661 · Published 2022-10-03 · Fixed in 1.4.0 CWE-79
Priority LOW 25
Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00619 · Published 2022-03-11 · Fixed in 1.3.0 CWE-79
Priority LOW 25
Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00573 · Published 2022-01-19 · Fixed in 1.2.2 CWE-79
Priority LOW 25
Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00642 · Published 2022-01-19 · Fixed in 1.2.2 CWE-79
Priority LOW 25
orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00655 · Published 2022-01-12 · Fixed in 1.2.1 CWE-79
Open these records in search → All records by CVSS severity
1 2 8 0 0
THREATIST.IORead the docs