# plone (PyPI) vulnerabilities

101 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/plone/

## Advisories (101)

### [CVE-2024-22889](https://cve.now/CVE-2024-22889): Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a…

- Severity: Medium 5.5
- Published: Mar 5, 2024
- Affected: through 6.0.9.

### [CVE-2024-0669](https://cve.now/CVE-2024-0669): Cross-Frame Scripting (XFS) on Plone CMS

- Severity: Medium 6.3
- Published: Jan 18, 2024
- Affected: fixed in 6.0.7.

### [CVE-2021-33926](https://cve.now/CVE-2021-33926): An issue in Plone CMS v.

- Severity: High 8.8
- Published: Feb 17, 2023
- Affected: from 4.3, fixed in 5.2.5.

### [CVE-2021-35959](https://cve.now/CVE-2021-35959): In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT…

- Severity: Unrated
- Published: Jun 30, 2021
- Affected: from 5.0, fixed in 5.2.5; from 5.0, through 5.2.4.

### [CVE-2021-33507](https://cve.now/CVE-2021-33507): Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products…

- Severity: Unrated
- Published: May 21, 2021
- Affected: through 5.2.4; fixed in 5.2.5.

### [CVE-2021-33508](https://cve.now/CVE-2021-33508): Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.

- Severity: Unrated
- Published: May 21, 2021
- Affected: fixed in 5.2.5; through 5.2.4.

### [CVE-2021-33509](https://cve.now/CVE-2021-33509): Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText…

- Severity: Unrated
- Published: May 21, 2021
- Affected: fixed in 5.2.5.

### [CVE-2021-33510](https://cve.now/CVE-2021-33510): Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.

- Severity: Unrated
- Published: May 21, 2021
- Affected: through 5.2.4; fixed in 5.2.5.

### [CVE-2021-33511](https://cve.now/CVE-2021-33511): Plone though 5.2.4 allows SSRF via the lxml parser.

- Severity: Unrated
- Published: May 21, 2021
- Affected: through 5.2.4; fixed in 5.2.5.

### [CVE-2021-33512](https://cve.now/CVE-2021-33512): Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.

- Severity: Unrated
- Published: May 21, 2021
- Affected: through 5.2.4; fixed in 5.2.5.

### [CVE-2021-33513](https://cve.now/CVE-2021-33513): Plone through 5.2.4 allows XSS via the inline\_diff methods in Products.CMFDiffTool.

- Severity: Unrated
- Published: May 21, 2021
- Affected: through 5.2.4; fixed in 5.2.5.

### [CVE-2021-3313](https://cve.now/CVE-2021-3313): Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload…

- Severity: Unrated
- Published: May 20, 2021
- Affected: fixed in 5.2.4.

### [CVE-2021-29002](https://cve.now/CVE-2021-29002): A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site\_title"…

- Severity: Unrated
- Published: Mar 24, 2021
- Affected: through 5.2.3.

### [CVE-2020-28736](https://cve.now/CVE-2020-28736): Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata…

- Severity: Unrated
- Published: Dec 30, 2020
- Affected: fixed in 5.2.3.

### [CVE-2020-28735](https://cve.now/CVE-2020-28735): Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

- Severity: Unrated
- Published: Dec 30, 2020
- Affected: fixed in 5.2.3.

### [CVE-2020-28734](https://cve.now/CVE-2020-28734): Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

- Severity: Unrated
- Published: Dec 30, 2020
- Affected: fixed in 5.2.3.

### [CVE-2020-7936](https://cve.now/CVE-2020-7936): An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone…

- Severity: Unrated
- Published: Jan 23, 2020
- Affected: from 4.0, fixed in 4.3.20; from 5.0rc1, fixed in 5.1.7; from 5.2.0, fixed in 5.2.2; from 4.0, fixed in 5.2.2.

### [CVE-2020-7937](https://cve.now/CVE-2020-7937): An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be…

- Severity: Unrated
- Published: Jan 23, 2020
- Affected: from 5.0, through 5.2.1; from 5.0, fixed in 5.2.2.

### [CVE-2020-7938](https://cve.now/CVE-2020-7938): plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.

- Severity: Unrated
- Published: Jan 23, 2020
- Affected: from 5.2.0, fixed in 5.2.2.

### [CVE-2020-7939](https://cve.now/CVE-2020-7939): SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries.

- Severity: Unrated
- Published: Jan 23, 2020
- Affected: from 4.0, through 5.2.1; from 4.0, fixed in 5.2.2.

### [CVE-2020-7940](https://cve.now/CVE-2020-7940): Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.

- Severity: Unrated
- Published: Jan 23, 2020
- Affected: from 4.3, fixed in 4.3.20; from 5.0rc1, fixed in 5.1.7; from 5.2.0, fixed in 5.2.2; from 4.3, fixed in 5.2.1.

### [CVE-2020-7941](https://cve.now/CVE-2020-7941): A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without…

- Severity: Unrated
- Published: Jan 23, 2020
- Affected: from 4.3, through 5.2.1; from 4.3, fixed in 5.2.2.

### [CVE-2013-7062](https://cve.now/CVE-2013-7062): Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through…

- Severity: Unrated
- Published: Jan 2, 2020
- Affected: from 3.3, fixed in 4.0a1; from 4.0, fixed in 4.0.10; from 4.1, fixed in 4.2a1; from 4.2, fixed in 4.3a1; from 4.3, fixed in 4.3.3; from 3.3, fixed in 3.3.6; from 4.0, fixed in 4.0.9; from 4.1, fixed in 4.1.6; from 4.3, fixed in 4.3.2.

### [CVE-2017-1000484](https://cve.now/CVE-2017-1000484): By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website.

- Severity: Unrated
- Published: Jan 3, 2018
- Affected: from 2.5, fixed in 5.1.0; from 2.5, fixed in 4.3.16; from 5.0.0, fixed in 5.1.0.

### [CVE-2017-1000483](https://cve.now/CVE-2017-1000483): Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1.

- Severity: Unrated
- Published: Jan 3, 2018
- Affected: from 2.5, fixed in 4.3.16; from 5, fixed in 5.1.0; from 2.5, fixed in 4.3.16; from 5.0, fixed in 5.1.0.

### [CVE-2017-1000482](https://cve.now/CVE-2017-1000482): A member of the Plone 2.5-5.1rc1 site could set javascript in the home\_page property of his profile, and have this executed when a visitor…

- Severity: Unrated
- Published: Jan 3, 2018
- Affected: from 2.5, fixed in 4.3.16; from 5, fixed in 5.1.0; from 2.5a1, fixed in 4.3.16; from 5.0a1, fixed in 5.1.0.

### [CVE-2017-1000481](https://cve.now/CVE-2017-1000481): When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came\_from' parameter set to the…

- Severity: Unrated
- Published: Jan 3, 2018
- Affected: from 2.5, fixed in 4.3.16; from 5, fixed in 5.1.0; from 2.5, fixed in 4.3.16; from 5, fixed in 5.1.0.

### [CVE-2015-7293](https://cve.now/CVE-2015-7293): Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

- Severity: Unrated
- Published: Sep 25, 2017
- Affected: fixed in 5.0a1.

### [CVE-2015-7318](https://cve.now/CVE-2015-7318): Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.

- Severity: Unrated
- Published: Sep 25, 2017
- Affected: from 3.3, fixed in 4.0a1.

### [CVE-2015-7316](https://cve.now/CVE-2015-7316): Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7…

- Severity: Unrated
- Published: Sep 25, 2017
- Affected: from 3.3, fixed in 4.0a1; from 4.0, fixed in 4.1a1; from 4.1, fixed in 4.2a1; from 4.2, fixed in 4.3a1; from 4.3, fixed in 4.3.7; from 5.0a1, fixed in 5.0rc2; from 3.3, fixed in 3.3.7; from 4.0, fixed in 4.0.11; from 4.1, fixed in 4.1.7; from 4.2, fixed in 4.2.8; from 4.3, fixed in 4.3.7; versions 5.0rc1.

### [CVE-2015-7315](https://cve.now/CVE-2015-7315): Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote…

- Severity: Unrated
- Published: Sep 25, 2017
- Affected: from 3.3, fixed in 4.0a1; from 4.0, fixed in 4.1a1; from 4.1, fixed in 4.2a1; from 4.2, fixed in 4.3a1; from 4.3, fixed in 4.3.7; from 5.0a1, fixed in 5.0rc2; from 3.3, through 3.3.6; from 4.0a1, through 4.0.10; from 4.1a1, through 4.1.6; from 4.2a1, through 4.2.7; from 4.3a1, through 4.3.6; versions 5.0rc1.

### [CVE-2017-5524](https://cve.now/CVE-2017-5524): Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive…

- Severity: Unrated
- Published: Mar 23, 2017
- Affected: from 4.0, fixed in 4.3.12; from 5.1a1, fixed in 5.1b1; from 5.0rc1, fixed in 5.0.7; fixed in 4.3.12; from 5.0a1, fixed in 5.0.7.

### [CVE-2016-7140](https://cve.now/CVE-2016-7140): Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x…

- Severity: Unrated
- Published: Mar 7, 2017
- Affected: from 5.0, fixed in 5.0.7; from 4.0, fixed in 4.3.12; from 3.3, fixed in 4.0a1; from 5.0a1, fixed in 5.0.7; from 3.3a1, fixed in 4.3.12.

### [CVE-2016-7139](https://cve.now/CVE-2016-7139): Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x…

- Severity: Unrated
- Published: Mar 7, 2017
- Affected: from 5.0, fixed in 5.0.6; from 4.0a1, fixed in 4.3.12; from 3.3, through 3.3.6; from 5.0, fixed in 5.0.7; from 4.0, fixed in 4.3.12; from 3.3, fixed in 4.0a1.

### [CVE-2016-7138](https://cve.now/CVE-2016-7138): Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x…

- Severity: Unrated
- Published: Mar 7, 2017
- Affected: from 5.0.0, through 5.0.6; from 4.0.0, through 4.3.11; from 3.3.0, through 3.3.6; from 5.0, fixed in 5.0.7; from 4.0, fixed in 4.3.12; from 3.3, fixed in 4.0a1.

### [CVE-2016-7137](https://cve.now/CVE-2016-7137): Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers…

- Severity: Unrated
- Published: Mar 7, 2017
- Affected: from 5.0, fixed in 5.0.7; from 4.0, fixed in 4.3.12; from 3.3, fixed in 4.0a1; from 5.0, through 5.0.6; from 4.0, through 4.3.11; from 3.3, through 3.3.6.

### [CVE-2016-7136](https://cve.now/CVE-2016-7136): z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a…

- Severity: Unrated
- Published: Mar 7, 2017
- Affected: from 5.0.0, through 5.0.6; from 4.0.0, through 4.3.11; from 5.0, fixed in 5.0.7; from 4.2, fixed in 4.3.12.

### [CVE-2016-7135](https://cve.now/CVE-2016-7135): Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary…

- Severity: Unrated
- Published: Mar 7, 2017
- Affected: from 5.0, fixed in 5.0.7; from 4.2, fixed in 4.3.12; from 5.0, fixed in 5.0.7; from 4.2, fixed in 4.3.12.

### [CVE-2016-4043](https://cve.now/CVE-2016-4043): Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions…

- Severity: Unrated
- Published: Feb 24, 2017
- Affected: from 5.0rc1, through 5.0.4; versions 5.1a1; from 5.0rc1, fixed in 5.1a2.

### [CVE-2016-4042](https://cve.now/CVE-2016-4042): Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.

- Severity: Unrated
- Published: Feb 24, 2017
- Affected: from 3.3, fixed in 5.1a2; from 5.0, fixed in 5.0.5; from 3.3, fixed in 4.3.10.

### [CVE-2016-4041](https://cve.now/CVE-2016-4041): Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers…

- Severity: Unrated
- Published: Feb 24, 2017
- Affected: from 3.3, fixed in 4.3.10; from 5.0, fixed in 5.0.5; from 5.1a1, fixed in 5.1a2; from 4.0, fixed in 5.1a2.

### [CVE-2016-7147](https://cve.now/CVE-2016-7147): Cross-site scripting (XSS) vulnerability in the manage\_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and…

- Severity: Unrated
- Published: Feb 4, 2017
- Affected: fixed in 4.3.12; from 5.0, fixed in 5.0.7; from 4.0, fixed in 4.3.12; from 5.0, fixed in 5.0.7.

### [CVE-2012-6661](https://cve.now/CVE-2012-6661): Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which…

- Severity: Unrated
- Published: Nov 3, 2014
- Affected: from 3.2.2, fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5508](https://cve.now/CVE-2012-5508): The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for…

- Severity: Unrated
- Published: Nov 3, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5500](https://cve.now/CVE-2012-5500): The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the…

- Severity: Unrated
- Published: Nov 3, 2014
- Affected: fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5507](https://cve.now/CVE-2012-5507): AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; from 3.2.2, fixed in 4.2.3; from 4.3a1, fixed in 4.3b1.

### [CVE-2012-5506](https://cve.now/CVE-2012-5506): python\_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a1, fixed in 4.3b1.

### [CVE-2012-5505](https://cve.now/CVE-2012-5505): atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5504](https://cve.now/CVE-2012-5504): Cross-site scripting (XSS) vulnerability in widget\_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5503](https://cve.now/CVE-2012-5503): ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5502](https://cve.now/CVE-2012-5502): Cross-site scripting (XSS) vulnerability in safe\_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5501](https://cve.now/CVE-2012-5501): at\_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5499](https://cve.now/CVE-2012-5499): python\_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption)…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: from 4.0, fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5498](https://cve.now/CVE-2012-5498): queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5497](https://cve.now/CVE-2012-5497): membership\_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5496](https://cve.now/CVE-2012-5496): kupu\_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 3.3.6; fixed in 4.0.

### [CVE-2012-5495](https://cve.now/CVE-2012-5495): python\_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5494](https://cve.now/CVE-2012-5494): Cross-site scripting (XSS) vulnerability in python\_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5493](https://cve.now/CVE-2012-5493): gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5492](https://cve.now/CVE-2012-5492): uid\_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5491](https://cve.now/CVE-2012-5491): z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5490](https://cve.now/CVE-2012-5490): Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5489](https://cve.now/CVE-2012-5489): The App.Undo.UndoSupport.get\_request\_var\_or\_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: from 3.2.2, fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5488](https://cve.now/CVE-2012-5488): python\_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5487](https://cve.now/CVE-2012-5487): The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2012-5486](https://cve.now/CVE-2012-5486): ZPublisher.HTTPRequest.\_scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: from 3.3.2, fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3.

### [CVE-2012-5485](https://cve.now/CVE-2012-5485): registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors…

- Severity: Unrated
- Published: Sep 30, 2014
- Affected: fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

### [CVE-2013-7061](https://cve.now/CVE-2013-7061): Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive…

- Severity: Unrated
- Published: May 2, 2014
- Affected: from 3.3b1, fixed in 4.3.3; from 3.3, fixed in 4.3.3.

### [CVE-2013-7060](https://cve.now/CVE-2013-7060): Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to…

- Severity: Unrated
- Published: May 2, 2014
- Affected: from 3.3, fixed in 4.3.3.

### [CVE-2013-4199](https://cve.now/CVE-2013-4199): (1) cb\_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 4.3, fixed in 4.3.2; from 4.2, fixed in 4.2.6; from 2.1, fixed in 4.1.1.

### [CVE-2013-4198](https://cve.now/CVE-2013-4198): mail\_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, through 4.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2013-4197](https://cve.now/CVE-2013-4197): member\_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2013-4196](https://cve.now/CVE-2013-4196): The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2013-4195](https://cve.now/CVE-2013-4195): Multiple open redirect vulnerabilities in (1) marmoset\_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2013-4194](https://cve.now/CVE-2013-4194): The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2013-4193](https://cve.now/CVE-2013-4193): typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2013-4192](https://cve.now/CVE-2013-4192): sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2013-4191](https://cve.now/CVE-2013-4191): zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2013-4190](https://cve.now/CVE-2013-4190): Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2013-4189](https://cve.now/CVE-2013-4189): Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, through 4.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2013-4188](https://cve.now/CVE-2013-4188): traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges…

- Severity: Unrated
- Published: Mar 11, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 4.3, fixed in 4.3.2; from 4.2, fixed in 4.2.6; from 2.1, fixed in 4.1.1.

### [CVE-2013-4200](https://cve.now/CVE-2013-4200): The isURLInPortal method in the URLTool class in in\_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1…

- Severity: Unrated
- Published: Jan 21, 2014
- Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

### [CVE-2011-4462](https://cve.now/CVE-2011-4462): Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably…

- Severity: Unrated
- Published: Dec 30, 2011
- Affected: fixed in 4.1.4.

### [CVE-2011-4030](https://cve.now/CVE-2011-4030): The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from…

- Severity: Unrated
- Published: Oct 10, 2011
- Affected: from 4.0, fixed in 4.0.10; from 4.1, fixed in 4.1.1; from 4.2a1, fixed in 4.2a3; from 4.0, fixed in 4.0.10; from 4.1, fixed in 4.1.1; from 4.2a1, fixed in 4.2a3.

### [CVE-2011-1340](https://cve.now/CVE-2011-1340): Cross-site scripting (XSS) vulnerability in skins/plone\_templates/default\_error\_message.pt in Plone before 2.5.3 allows remote attackers…

- Severity: Unrated
- Published: Aug 5, 2011
- Affected: fixed in 2.5.3.

### [CVE-2011-2528](https://cve.now/CVE-2011-2528): Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2)…

- Severity: Unrated
- Published: Jul 19, 2011
- Affected: from 3.3.2, fixed in 3.3.6.

### [CVE-2011-1950](https://cve.now/CVE-2011-1950): plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified…

- Severity: Unrated
- Published: Jun 6, 2011
- Affected: fixed in 4.1.1; from 4.0.1, fixed in 4.0.6; from 4.1.0, fixed in 4.1.1.

### [CVE-2011-1949](https://cve.now/CVE-2011-1949): Cross-site scripting (XSS) vulnerability in the safe\_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote…

- Severity: Unrated
- Published: Jun 6, 2011
- Affected: fixed in 4.1.1; from 3.3.2, fixed in 3.3.6; from 4.0a0, fixed in 4.0.6; from 4.1a0, fixed in 4.1.1.

### [CVE-2011-1948](https://cve.now/CVE-2011-1948): Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a…

- Severity: Unrated
- Published: Jun 6, 2011
- Affected: fixed in 4.1.1.

### [CVE-2011-0720](https://cve.now/CVE-2011-0720): Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain…

- Severity: Unrated
- Published: Feb 3, 2011
- Affected: from 2.5, fixed in 4.0.4; fixed in 4.0.1.

### [CVE-2010-2422](https://cve.now/CVE-2010-2422): Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to…

- Severity: Unrated
- Published: Jun 23, 2010
- Affected: from 2.1, fixed in 3.3.6; fixed in 3.3.5.

### [CVE-2009-0662](https://cve.now/CVE-2009-0662): The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows…

- Severity: Unrated
- Published: Apr 23, 2009
- Affected: from 3.0, through 3.1; through 3.2; through 3.3; through 3.4; through 3.5.

### [CVE-2008-4571](https://cve.now/CVE-2008-4571): Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web…

- Severity: Unrated
- Published: Oct 15, 2008
- Affected: fixed in 3.0.4.

### [CVE-2008-1396](https://cve.now/CVE-2008-1396): Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication…

- Severity: Unrated
- Published: Mar 20, 2008
- Affected: through 3.1.7.

### [CVE-2008-1394](https://cve.now/CVE-2008-1394): Plone CMS before 3 places a base64 encoded form of the username and password in the \_\_ac cookie for all user accounts, which makes it…

- Severity: Unrated
- Published: Mar 20, 2008
- Affected: fixed in 3.0.

### [CVE-2008-1393](https://cve.now/CVE-2008-1393): Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the \_\_ac cookie for the…

- Severity: Unrated
- Published: Mar 20, 2008
- Affected: fixed in 3.0.

### [CVE-2008-0164](https://cve.now/CVE-2008-0164): Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary…

- Severity: Unrated
- Published: Mar 20, 2008
- Affected: fixed in 3.1.

### [CVE-2007-5741](https://cve.now/CVE-2007-5741): Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled…

- Severity: Unrated
- Published: Nov 7, 2007
- Affected: from 2.5, fixed in 2.5.5; from 3.0, fixed in 3.0.3; from 2.5, fixed in 2.5.5; from 3.0, fixed in 3.0.3.

### [CVE-2006-4249](https://cve.now/CVE-2006-4249): Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to…

- Severity: Unrated
- Published: Dec 7, 2006
- Affected: from 2.5, fixed in 2.5.2.

### [CVE-2006-4247](https://cve.now/CVE-2006-4247): Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the…

- Severity: Unrated
- Published: Sep 29, 2006
- Affected: from 2.5, fixed in 2.5.1.

### [CVE-2006-1711](https://cve.now/CVE-2006-1711): Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3)…

- Severity: Unrated
- Published: Apr 11, 2006
- Affected: fixed in 2.0.6; from 2.1.0; fixed in 2.0.6; from 2.1.0, through 2.1.2; versions 2.5-beta1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/plone
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.