Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

opensource-workshop/connect-cms

6 known vulnerabilities (5 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 5 high, 1 medium
Registry
Packagist

Advisories 6

  • Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

    Affected: fixed in 1.41.1; from 2.0.0, fixed in 2.41.1.

  • Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature

    Affected: fixed in 1.41.1; from 2.0.0, fixed in 2.41.1.

  • CVE-2026-32279Medium 6.8

    Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin

    Affected: fixed in 1.41.1; from 2.0.0, fixed in 2.41.1.

  • Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

    Affected: fixed in 1.41.1; from 2.0.0, fixed in 2.41.1.

  • Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

    Affected: from 1.35.0, fixed in 1.41.1; from 2.35.0, fixed in 2.41.1.

  • Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin

    Affected: fixed in 1.41.1; from 2.0.0, fixed in 2.41.1.