Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

silverstripe/framework

37 known vulnerabilities (1 high, 12 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
37 · 1 high, 12 medium
Registry
Packagist

Advisories 37

  • CVE-2026-54720Medium 5.4

    Silverstripe Framework: Possible XSS attack through media embed

    Affected: fixed in 6.2.2.

  • CVE-2025-30148Medium 5.4

    Silverstripe Framework has a XSS vulnerability in HTML editor

    Affected: fixed in 5.3.23.

  • CVE-2024-53277Medium 5.4

    Cross-site Scripting in form messages in silverstripe framework

    Affected: fixed in 5.3.8.

  • CVE-2024-47605Medium 5.4

    Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin

    Affected: fixed in 5.3.8.

  • CVE-2024-32981Medium 5.4

    Cross-site Scripting vulnerability with encoded payload in silverstripe/framework

    Affected: fixed in 5.2.16.

  • CVE-2023-48714Medium 4.3

    Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter

    Affected: fixed in 4.13.39; from 5.0.0, fixed in 5.1.11.

  • CVE-2023-22729Medium 5.4

    Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen

    Affected: fixed in 4.12.5.

  • CVE-2023-22728Medium 4.3

    Silverstripe Framework has missing permission check of canView in GridFieldPrintButton

    Affected: fixed in 4.12.5.

  • CVE-2022-37430Medium 5.4

    Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).

    Affected: from 4.0.0, fixed in 4.11.13.

  • CVE-2022-37429Medium 5.4

    Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by…

    Affected: from 4.0.0, fixed in 4.11.13.

  • CVE-2022-38724Medium 5.4

    Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow…

    Affected: from 4.0.0, fixed in 4.11.13.

  • CVE-2022-38462Medium 6.1

    Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or…

    Affected: from 4.0.0, fixed in 4.11.13.

  • Silverstripe silverstripe/framework through 4.11 allows SQL Injection.

    Affected: from 4.0.0, fixed in 4.10.11; from 4.11.0, fixed in 4.11.14.

  • In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR).

    Affected: from 4.0.0, fixed in 4.10.9.

  • Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by…

    Affected: from 4.0.0, fixed in 4.10.9.

Show all 37 advisoriesShow fewer advisories

  • Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML…

    Affected: from 4.0.0, fixed in 4.10.9.

  • SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser.

    Affected: from 4.0.0, fixed in 4.7.4.

  • In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.

    Affected: from 3.0.0, fixed in 4.7.4.

  • In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which…

    Affected: from 3.0.0, fixed in 3.7.5.

  • In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose…

    Affected: from 4.0.0, fixed in 4.4.7; from 4.5.0, fixed in 4.5.4.

  • Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be…

    Affected: from 4.0.0, fixed in 4.4.7; from 4.5.0, fixed in 4.5.4; from 3.0.0, fixed in 3.7.5.

  • In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads"…

    Affected: from 4.0.0, fixed in 4.4.6.

  • SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.

    Affected: from 4.0.0, fixed in 4.4.0; through 3.6.

  • SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms.

    Affected: from 4.5.0, fixed in 4.5.2; from 4.0.0, fixed in 4.4.5.

  • In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can…

    Affected: from 4.0.0, fixed in 4.3.5; from 4.4.0, fixed in 4.4.4.

  • In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.

    Affected: from 4.4.0, fixed in 4.4.4; from 4.3.0, fixed in 4.3.5.

  • In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.

    Affected: from 4.0.0, fixed in 4.3.5; from 4.4.0, fixed in 4.4.4.

  • In SilverStripe assets 4.0, there is broken access control on files.

    Affected: from 4.0.0, fixed in 4.3.5; from 4.4.0, fixed in 4.4.4.

  • SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.

    Affected: from 3.0.0, fixed in 4.3.5; from 4.4.0-rc1, fixed in 4.4.4.

  • SilverStripe through 4.3.3 allows session fixation in the "change password" form.

    Affected: from 3.7.0, fixed in 3.7.4; from 4.4.0, fixed in 4.4.4; from 3.6.0, fixed in 3.6.8; from 4.0.0, fixed in 4.3.5.

  • SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile().

    Affected: fixed in 3.6.8; from 3.7.0, fixed in 3.7.4; from 4.0.0, fixed in 4.3.6; from 4.4.0, fixed in 4.4.4.

  • In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.

    Affected: from 4.1.0, fixed in 4.3.5.

  • All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows…

    Affected: from 3.0.0, fixed in 3.6.7; from 4.0.0, fixed in 4.0.7; from 3.7.0, fixed in 3.7.3; from 4.1.0, fixed in 4.1.5; from 4.2.0, fixed in 4.2.4; from 4.3.0, fixed in 4.3.1.

  • In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain…

    Affected: fixed in 3.5.6; from 3.6.0, fixed in 3.6.3; from 4.0.0, fixed in 4.0.1.

  • Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and…

    Affected: through 3.1.13.

  • Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to…

    Affected: from 2.3, fixed in 2.3.13; from 2.4, fixed in 2.4.7.

  • Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or…

    Affected: fixed in 2.3.5.