# silverstripe/cms (Packagist) vulnerabilities 13 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/silverstripe/cms ## Advisories (13) ### [CVE-2026-54717](https://cve.now/CVE-2026-54717): Silverstripe: XSS in breadcrumbs in page list view - Severity: Medium 5.4 - Published: Aug 6, 2026 - Affected: fixed in 6.2.1. ### [CVE-2022-37421](https://cve.now/CVE-2022-37421): Silverstripe silverstripe/cms through 4.11.0 allows XSS. - Severity: Medium 5.4 - Published: Nov 23, 2022 - Affected: from 4.0.0, fixed in 4.11.3. ### [CVE-2020-9311](https://cve.now/CVE-2020-9311): In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which… - Severity: Unrated - Published: Jul 15, 2020 - Affected: through 4.5.0. ### [CVE-2020-9309](https://cve.now/CVE-2020-9309): Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions (for… - Severity: Unrated - Published: Jul 15, 2020 - Affected: through 4.5.0. ### [CVE-2020-6164](https://cve.now/CVE-2020-6164): In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose… - Severity: Unrated - Published: Jul 15, 2020 - Affected: through 4.5.0. ### [CVE-2019-12204](https://cve.now/CVE-2019-12204): In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access. - Severity: Unrated - Published: Sep 25, 2019 - Affected: from 4.4.0, fixed in 4.4.4. ### [CVE-2017-12849](https://cve.now/CVE-2017-12849): Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers… - Severity: Unrated - Published: Oct 12, 2017 - Affected: fixed in 3.5.5; from 3.6, fixed in 3.6.1. ### [CVE-2017-14498](https://cve.now/CVE-2017-14498): SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2)… - Severity: Unrated - Published: Sep 15, 2017 - Affected: fixed in 3.6.1. ### [CVE-2017-5197](https://cve.now/CVE-2017-5197): There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. - Severity: Unrated - Published: Mar 6, 2017 - Affected: fixed in 3.4.4; from 3.5.0, fixed in 3.5.2. ### [CVE-2015-8606](https://cve.now/CVE-2015-8606): Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote… - Severity: Unrated - Published: Apr 13, 2016 - Affected: fixed in 3.1.16; from 3.2.0, fixed in 3.2.1. ### [CVE-2015-5062](https://cve.now/CVE-2015-5062): Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and… - Severity: Unrated - Published: Jun 24, 2015 - Affected: through 3.1.13. ### [CVE-2011-4962](https://cve.now/CVE-2011-4962): code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a… - Severity: Unrated - Published: Sep 17, 2012 - Affected: from 2.4.0, fixed in 2.4.6. ### [CVE-2010-1593](https://cve.now/CVE-2010-1593): Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or… - Severity: Unrated - Published: Apr 28, 2010 - Affected: fixed in 2.3.5. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/silverstripe/cms Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.