Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: orchardcms Component: Orchardcore Clear all filters
TI-2022-13899 CVE-2022-32173 · GHSA-5gg9-gwj4-mqmj

OrchardCore - HTML Injection

Priority LOW 26

In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00661 Published 2022-10-03 Fixed in 1.4.0 CWE-79
TI-2022-00728 CVE-2022-0821 · GHSA-wg4r-r6qv-94rv

Improper Authorization in orchardcms/orchardcore

Priority LOW 30

Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0074 Published 2022-03-10 Fixed in 1.3.0 CWE-285
TI-2022-00101 CVE-2022-0159 · GHSA-6w5m-jgc5-8cgc

Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore

Priority LOW 25

orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00655 Published 2022-01-12 Fixed in 1.2.1 CWE-79