Priority MEDIUM 44
An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00287 · Published 2026-10-07 · No fix listed CWE-89
Priority MEDIUM 48
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00416 · Published 2026-10-07 · No fix listed CWE-94
Priority LOW 24
Missing authorization vulnerability exists in Movable Type.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00249 · Published 2026-05-20 · No fix listed CWE-862
Priority MEDIUM 49
Movable Type provided by Six Apart Ltd.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00672 · Published 2026-04-08 · No fix listed CWE-94
Priority LOW 36
Movable Type provided by Six Apart Ltd.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00363 · Published 2026-04-08 · No fix listed CWE-89
Priority LOW 22
If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data.
CVSS 4.0MEDIUM 4.8· Network · Low privileges · User interaction · EPSS 0.00246 · Published 2026-02-04 · No fix listed CWE-1236
Priority LOW 23
A non-administrative user can upload malicious files.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.0023 · Published 2026-02-04 · No fix listed CWE-434
Priority LOW 22
Movable Type contains a stored cross-site scripting vulnerability in Export Sites.
CVSS 4.0MEDIUM 4.8· Network · Low privileges · User interaction · EPSS 0.00237 · Published 2026-02-04 · No fix listed CWE-79
Priority LOW 22
Movable Type contains a stored cross-site scripting vulnerability in Edit Comment.
CVSS 4.0MEDIUM 4.8· Network · Low privileges · User interaction · EPSS 0.00237 · Published 2026-02-04 · No fix listed CWE-79
Priority LOW 21
Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page.
CVSS 4.0MEDIUM 4.6· Network · High privileges · User interaction · EPSS 0.00234 · Published 2025-10-23 · No fix listed CWE-79
Priority LOW 21
Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page.
CVSS 4.0MEDIUM 4.6· Network · High privileges · User interaction · EPSS 0.00234 · Published 2025-10-23 · No fix listed CWE-79
Priority LOW 23
URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type.
CVSS 4.0MEDIUM 5.1· Network · No auth · User interaction · EPSS 0.00208 · Published 2025-08-20 · No fix listed CWE-601
Priority LOW 36
Movable Type contains an issue with use of less trusted source.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00175 · Published 2025-08-20 · No fix listed CWE-348
Priority LOW 24
Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00225 · Published 2025-02-19 · No fix listed CWE-79
Priority LOW 27
Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00258 · Published 2025-02-19 · No fix listed CWE-79
Priority LOW 24
Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00225 · Published 2025-02-19 · No fix listed CWE-79
Priority LOW 25
Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00441 · Published 2023-10-30 · No fix listed CWE-79
Priority LOW 28
Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type 6.8.7 and earlier (M…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00541 · Published 2022-12-07 · No fix listed CWE-79
Priority LOW 30
Improper validation of syntactic correctness of input vulnerability exist in Movable Type series.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00648 · Published 2022-12-07 · No fix listed CWE-20
Priority LOW 36
Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/o…
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01045 · Published 2022-12-07 · No fix listed CWE-94
Priority MEDIUM 46
Movable Type XMLRPC API provided by Six Apart Ltd.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02081 · Published 2022-08-24 · No fix listed CWE-94
Priority LOW 25
Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspeci…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00605 · Published 2021-10-26 · No fix listed CWE-79
Priority HIGH 84
Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.88144 · Published 2021-10-26 · No fix listed CWE-78
Priority LOW 29
Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.009 · Published 2021-08-26 · No fix listed CWE-79
Priority LOW 29
Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4903 and earlier (Movabl…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00904 · Published 2021-08-26 · No fix listed CWE-79
Load more
THREATIST.IORead the docs