# cve.now: SIX Apart Ltd.

The newest entries naming SIX Apart Ltd. as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-103668](https://cve.now/CVE-2026-103668.md): An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an (CVSS 8.6)
- [CVE-2026-96408](https://cve.now/CVE-2026-96408.md): A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbit (CVSS 9.4)
- [CVE-2026-44392](https://cve.now/CVE-2026-44392.md): Missing authorization vulnerability exists in Movable Type. (CVSS 4.3)
- [CVE-2026-25776](https://cve.now/CVE-2026-25776.md): Movable Type provided by Six Apart Ltd. (CVSS 9.8)
- [CVE-2026-33088](https://cve.now/CVE-2026-33088.md): Movable Type provided by Six Apart Ltd. (CVSS 7.3)
- [CVE-2026-24447](https://cve.now/CVE-2026-24447.md): If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. (CVSS 6.5)
- [CVE-2026-23704](https://cve.now/CVE-2026-23704.md): A non-administrative user can upload malicious files. (CVSS 6.5)
- [CVE-2026-22875](https://cve.now/CVE-2026-22875.md): Movable Type contains a stored cross-site scripting vulnerability in Export Sites. (CVSS 5.4)
- [CVE-2026-21393](https://cve.now/CVE-2026-21393.md): Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. (CVSS 5.4)
- [CVE-2025-62499](https://cve.now/CVE-2025-62499.md): Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. (CVSS 4.8)
- [CVE-2025-54856](https://cve.now/CVE-2025-54856.md): Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. (CVSS 4.8)
- [CVE-2025-55706](https://cve.now/CVE-2025-55706.md): URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. (CVSS 4.3)
- [CVE-2025-53522](https://cve.now/CVE-2025-53522.md): Movable Type contains an issue with use of less trusted source. (CVSS 5.3)
- [CVE-2025-24841](https://cve.now/CVE-2025-24841.md): Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. (CVSS 5.4)
- [CVE-2025-25054](https://cve.now/CVE-2025-25054.md): Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. (CVSS 6.1)
- [CVE-2025-22888](https://cve.now/CVE-2025-22888.md): Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. (CVSS 5.4)
- [CVE-2023-45746](https://cve.now/CVE-2023-45746.md): Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. (CVSS 5.4)
- [CVE-2022-45122](https://cve.now/CVE-2022-45122.md): Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 (CVSS 6.1)
- [CVE-2022-45113](https://cve.now/CVE-2022-45113.md): Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. (CVSS 6.5)
- [CVE-2022-43660](https://cve.now/CVE-2022-43660.md): Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with P (CVSS 7.2)
- [CVE-2022-38078](https://cve.now/CVE-2022-38078.md): Movable Type XMLRPC API provided by Six Apart Ltd. (no CVSS)
- [CVE-2020-5669](https://cve.now/CVE-2020-5669.md): Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier (no CVSS)
- [CVE-2021-20837](https://cve.now/CVE-2021-20837.md): Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r (no CVSS)
- [CVE-2021-20815](https://cve.now/CVE-2021-20815.md): Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Mo (no CVSS)
- [CVE-2021-20814](https://cve.now/CVE-2021-20814.md): Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and ear (no CVSS)
- [CVE-2021-20813](https://cve.now/CVE-2021-20813.md): Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) (no CVSS)
- [CVE-2021-20812](https://cve.now/CVE-2021-20812.md): Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Typ (no CVSS)
- [CVE-2021-20811](https://cve.now/CVE-2021-20811.md): Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Mova (no CVSS)
- [CVE-2021-20810](https://cve.now/CVE-2021-20810.md): Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), (no CVSS)
- [CVE-2021-20809](https://cve.now/CVE-2021-20809.md): Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Mo (no CVSS)
- [CVE-2021-20808](https://cve.now/CVE-2021-20808.md): Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type (no CVSS)
- [CVE-2021-20665](https://cve.now/CVE-2021-20665.md): Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Mo (no CVSS)
- [CVE-2021-20664](https://cve.now/CVE-2021-20664.md): Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Typ (no CVSS)
- [CVE-2021-20663](https://cve.now/CVE-2021-20663.md): Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable (no CVSS)
- [CVE-2020-5577](https://cve.now/CVE-2020-5577.md): Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable (no CVSS)
- [CVE-2020-5576](https://cve.now/CVE-2020-5576.md): Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable (no CVSS)
- [CVE-2020-5575](https://cve.now/CVE-2020-5575.md): Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced (no CVSS)
- [CVE-2020-5574](https://cve.now/CVE-2020-5574.md): HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Typ (no CVSS)
- [CVE-2020-5528](https://cve.now/CVE-2020-5528.md): Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlie (no CVSS)
- [CVE-2019-6025](https://cve.now/CVE-2019-6025.md): Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 (no CVSS)
- [CVE-2018-0672](https://cve.now/CVE-2018-0672.md): Cross-site scripting vulnerability in Movable Type versions prior to Ver. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/six-apart
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.