Vulnerabilities

TI-2026-84794 CVE-2026-55186 · GHSA-68wq-phq7-p2vg

Silverstripe MFA lets attackers bypass MFA during password reset

LOW 19

Silverstripe MFA provides multi-factor authentication for Silverstripe CMS.

CVSS 3.1MEDIUM 4.2 Network Low privileges No interaction EPSS 0.00278 Published 2026-11-03 Fixed in 6.0.0 CWE-288

TI-2026-40268 CVE-2026-55779 · GHSA-m4g4-86qc-v8w7

Silverstripe Versioned: XSS in archive admin restore

LOW 24

Silverstripe Versioned provides versioning for Silverstripe models.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00338 Published 2026-08-28 Fixed in 3.2.1 CWE-79

TI-2026-39532 CVE-2026-54718 · GHSA-39mm-rwm3-29jp

Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template

LOW 36

Silverstripe Advanced Workflow is a highly configurable step-based workflow module.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01047 Published 2026-08-27 Fixed in 6.4.5, 7.1.3 +1 CWE-1336

TI-2026-39535 CVE-2026-54721 · GHSA-g8wr-r2v2-vqc6

Silverstripe UserForms: Remote code execution via userforms email subject

MEDIUM 41

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00733 Published 2026-08-27 Fixed in 6.4.9, 7.0.7 +1 CWE-94

TI-2026-39531 CVE-2026-54717 · GHSA-w3cp-g2pf-65wh

Silverstripe: XSS in breadcrumbs in page list view

LOW 24

Silverstripe CMS is an open source content management system.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00338 Published 2026-08-06 Fixed in 6.2.1 CWE-79

TI-2026-39534 CVE-2026-54720 · GHSA-gvrw-qqp5-jgc5

Silverstripe Framework: Possible XSS attack through media embed

LOW 24

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00263 Published 2026-07-01 Fixed in 6.2.2 CWE-79

TI-2026-19954 CVE-2026-24749 · GHSA-jgcf-rf45-2f8v

Silverstripe Assets Module has a DBFile::getURL() permission bypass

LOW 30

The Silverstripe Assets Module is a required component of Silverstripe Framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00398 Published 2026-04-16 Fixed in 2.4.5, 3.1.3 CWE-863

TI-2025-21487 CVE-2025-30148 · GHSA-rhx4-hvx9-j387

Silverstripe Framework has a XSS vulnerability in HTML editor

LOW 24

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00298 Published 2025-04-10 Fixed in 5.3.23 CWE-79

TI-2025-18866 CVE-2025-25197 · GHSA-x8xm-c7p8-2pj2

Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports

LOW 24

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00316 Published 2025-04-10 Fixed in 5.3.12 CWE-79

TI-2024-35739 CVE-2024-53277 · GHSA-ff6q-3c9c-6cf5

Cross-site Scripting in form messages in silverstripe framework

LOW 24

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00326 Published 2025-01-14 Fixed in 5.3.8 CWE-79

TI-2024-31885 CVE-2024-47605 · GHSA-7cmp-cgg8-4c82

Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin

LOW 27

silverstripe-asset-admin is a silverstripe assets gallery for asset management.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.01181 Published 2025-01-14 Fixed in 5.3.8 CWE-79

TI-2024-21847 CVE-2024-32981 · GHSA-chx7-9x8h-r5mg

Cross-site Scripting vulnerability with encoded payload in silverstripe/framework

LOW 24

Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00346 Published 2024-07-17 Fixed in 5.2.16 CWE-79

TI-2024-19653 CVE-2024-29885 · GHSA-89q6-98xx-4ffw

Reports are still accessible even when `canView()` returns false in silverstripe/reports

LOW 20

silverstripe/reports is an API for creating backend reports in the Silverstripe Framework.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00404 Published 2024-07-17 Fixed in 5.2.3 CWE-200

TI-2023-27193 CVE-2023-49783 · GHSA-j3m6-gvm8-mhvw

No permission checks for editing/deleting records with CSV import form

LOW 20

Silverstripe Admin provides a basic management interface for the Silverstripe Framework.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00341 Published 2024-01-23 Fixed in 1.13.19, 2.1.8 CWE-863

TI-2023-26553 CVE-2023-48714 · GHSA-qm2j-qvq3-j29v

Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter

LOW 20

Silverstripe Framework is the framework that forms the base of the Silverstripe content management system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00355 Published 2024-01-23 Fixed in 4.13.39, 5.1.11 CWE-200

TI-2023-23907 CVE-2023-44401 · GHSA-jgph-w8rh-xf5p

Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data

LOW 24

The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00419 Published 2024-01-23 Fixed in 4.3.7, 5.1.3 CWE-863

TI-2023-21053 CVE-2023-40180 · GHSA-v23w-pppm-jh66

Denial of service vulnerability in silverstripe-graphql via recursive queries

LOW 35

silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01126 Published 2023-10-16 Fixed in 3.8.2, 4.1.3 +3 CWE-400

TI-2023-08903 CVE-2023-22729 · GHSA-fw84-xgm8-9jmv

Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen

LOW 28

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00419 Published 2023-04-26 Fixed in 4.12.5 CWE-601

TI-2023-08902 CVE-2023-22728 · GHSA-jh3w-6jp2-vqqm

Silverstripe Framework has missing permission check of canView in GridFieldPrintButton

LOW 21

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00486 Published 2023-04-26 Fixed in 4.12.5 CWE-862

TI-2023-12683 CVE-2023-28104 · GHSA-67g8-c724-8mp3

silverstripe/graphql Denial of Service vulnerability

MEDIUM 41

`silverstripe/graphql` serves Silverstripe data as GraphQL representations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01055 Published 2023-03-16 Fixed in 4.1.2, 4.2.3 CWE-770

TI-2022-20935 CVE-2022-42949 · GHSA-cx45-565q-6qx8

Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions.

MEDIUM 40

Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00559 Published 2022-12-20 Fixed in 2.6.1 CWE-732

TI-2022-17851 CVE-2022-38147 · GHSA-vv3r-fxqp-vr3f

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).

LOW 25

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0057 Published 2022-11-23 Fixed in 1.11.1 CWE-79

TI-2022-17849 CVE-2022-38145 · GHSA-66jf-xm2m-7m8r

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote…

LOW 25

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00657 Published 2022-11-23 Fixed in 1.11.1 CWE-79

TI-2022-17496 CVE-2022-37430 · GHSA-qw4w-vq8v-2wcv

Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).

LOW 25

Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0057 Published 2022-11-23 Fixed in 4.11.13 CWE-79

TI-2022-17495 CVE-2022-37429 · GHSA-wc6r-4ggc-79w5

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript…

LOW 25

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00523 Published 2022-11-23 Fixed in 4.11.13 CWE-79

Vulnerabilities

Filters