Priority LOW 29
Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00327 · Published 2026-06-10 · No fix listed CWE-36
Priority MEDIUM 62
A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00355 · Published 2025-09-02 · Fixed in 6.4.3 CWE-20
Priority MEDIUM 58
Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00325 · Published 2025-06-09 · No fix listed CWE-79
Priority MEDIUM 58
Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00315 · Published 2025-01-22 · Fixed in 6.4.2 CWE-79
Priority HIGH 72
SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the findbywhereclause function
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00551 · Published 2025-01-03 · No fix listed CWE-89
Priority MEDIUM 52
An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01434 · Published 2024-08-16 · No fix listed CWE-521
Priority MEDIUM 62
An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0122 · Published 2024-08-16 · No fix listed CWE-400
Priority MEDIUM 58
In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00767 · Published 2024-07-09 · No fix listed CWE-79
Priority HIGH 82
Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00935 · Published 2024-06-03 · Fixed in 6.3.5 CWE-288
Priority LOW 25
Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00367 · Published 2024-05-22 · No fix listed CWE-79
Priority LOW 21
The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00516 · Published 2023-12-13 · Fixed in 6.3.2 CWE-284
Priority LOW 38
Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00383 · Published 2023-12-13 · Fixed in 6.3.2 CWE-352
Priority MEDIUM 58
Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0041 · Published 2023-12-13 · Fixed in 6.3.2 CWE-284
Priority LOW 25
Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00477 · Published 2023-12-13 · Fixed in 6.3.2 CWE-79
Priority LOW 34
The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00766 · Published 2023-12-13 · Fixed in 6.3.2
Priority LOW 38
The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00391 · Published 2023-12-13 · Fixed in 6.3.2 CWE-352
Priority LOW 23
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00629 · Published 2023-12-13 · Fixed in 6.3.2 CWE-284
Priority HIGH 70
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00721 · Published 2023-12-13 · Fixed in 6.3.2 CWE-863
Priority MEDIUM 50
Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call.
CVSS 3.0CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.05042 · Published 2019-04-09 · No fix listed CWE-22
THREATIST.IORead the docs