Read the docs

sulu

Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

sulu records in CISA KEV

No sulu vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Sulu 11 records MEDIUM Sulu-standard 1 record LOW Suluformbundle 1 record LOW

Records

19 records

TI-2021-19642 CVE-2021-43836 · GHSA-vx6j-pjrh-vgjh

PHP file inclusion in the Sulu admin panel

Priority MEDIUM 42

Sulu is an open-source PHP content management system based on the Symfony framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02047 Published 2021-12-15 Fixed in 1.6.44, 2.2.18 +2 CWE-22
TI-2021-12405 CVE-2021-32737 · GHSA-gm2x-6475-g9r8

XSS Injection in Media Collection Title was possible

Priority LOW 38

Sulu is an open-source PHP content management system based on the Symfony framework.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.00665 Published 2021-07-02 Fixed in 1.6.41 CWE-79
TI-2025-30243 CVE-2025-47778 · GHSA-f6rx-hf55-4255

Sulu vulnerable to XXE in SVG File upload Inspector

Priority LOW 36

Sulu is an open-source PHP content management system based on the Symfony framework.

CVSS 4.0MEDIUM 6.1 Network High privileges No interaction EPSS 0.00469 Published 2025-05-14 Fixed in 2.5.25, 2.6.9 +1 CWE-611
TI-2021-19641 CVE-2021-43835 · GHSA-84px-q68r-2fc9

Privilege escalation in the Sulu Admin panel

Priority LOW 34

Sulu is an open-source PHP content management system based on the Symfony framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01172 Published 2021-12-15 Fixed in 2.2.18, 2.3.8 +1 CWE-269
TI-2021-18008 CVE-2021-41169 · GHSA-h58v-g3q6-q9fx

Improper Neutralization HTML tags in sulu/sulu

Priority LOW 28

Sulu is an open-source PHP content management system based on the Symfony framework.

CVSS 3.1MEDIUM 6.2 Network High privileges User interaction EPSS 0.00591 Published 2021-10-21 Fixed in 1.6.43 CWE-79
TI-2020-11905 CVE-2020-15132 · GHSA-wfm4-pq59-wg6r

Reset Password / Login vulnerability in Sulu

Priority LOW 26

In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01112 Published 2020-08-05 Fixed in 1.6.35, 2.0.10 +2 CWE-209
TI-2026-56812 CVE-2026-82395 · GHSA-h6cx-gjxx-v25c

Sulu: Media move/update authorization bypass (IDOR)

Priority LOW 24

Sulu is an open-source PHP content management system based on the Symfony framework.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00427 Published 2026-08-31 Fixed in 2.6.25, 3.0.8 CWE-639
TI-2026-26658 CVE-2026-34372 · GHSA-6h7h-m7p5-hjqp

Sulu checks fix permissions for subentities endpoints

Priority LOW 24

Sulu is an open-source PHP content management system based on the Symfony framework.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00268 Published 2026-03-31 Fixed in 2.6.22, 3.0.5 CWE-288
TI-2024-31898 CVE-2024-47618 · GHSA-255w-87rh-rg44

Sulu vulnerable to XSS via uploaded SVG

Priority LOW 23

Sulu is a PHP content management system.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0035 Published 2024-10-03 Fixed in 2.5.21, 2.6.5 CWE-79
TI-2023-20482 CVE-2023-39343 · GHSA-wmwf-49vv-p3mr

Sulu Observable Response Discrepancy on Admin Login

Priority LOW 21

Sulu is an open-source PHP content management system based on the Symfony framework.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00622 Published 2023-08-04 Fixed in 2.5.10 CWE-204
Open these records in search →