Priority LOW 31
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00363 · Published 2026-10-30 · No fix listed CWE-863
Priority MEDIUM 56
Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00473 · Published 2026-01-30 · No fix listed CWE-79
Priority MEDIUM 42
Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS).
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.00832 · Published 2022-11-25 · No fix listed CWE-79
Priority LOW 26
In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00661 · Published 2022-10-03 · Fixed in 1.4.0 CWE-79
Priority LOW 25
Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00619 · Published 2022-03-11 · Fixed in 1.3.0 CWE-79
Priority LOW 30
Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0074 · Published 2022-03-10 · Fixed in 1.3.0 CWE-285
Priority LOW 29
Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0074 · Published 2022-03-10 · Fixed in 1.3.0 CWE-79
Priority LOW 25
Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00642 · Published 2022-01-19 · Fixed in 1.2.2 CWE-79
Priority LOW 25
Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00573 · Published 2022-01-19 · Fixed in 1.2.2 CWE-79
Priority LOW 25
orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00655 · Published 2022-01-12 · Fixed in 1.2.1 CWE-79
Priority HIGH 73
In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01058 · Published 2021-10-10 · No fix listed CWE-613
THREATIST.IORead the docs