CVE-2026-28413

< 2.1.0

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login

5.3MEDIUM

CVE-2024-22889

all versions

Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via se

7.5HIGH

CVE-2024-23756

all versions

The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers

7.5HIGH

CVE-2024-23054

all versions

An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a pac

9.8CRITICAL

CVE-2024-23055

all versions

An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validatio

6.1MEDIUM

CVE-2024-0669

< 6.0.7

A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malici

6.3MEDIUM

CVE-2023-41048

< 5.6.1

plone.namedfile allows users to handle File and Image fields targeting, but not depending on, Plone Dexterity content. Prior t

3.7LOW

CVE-2021-33926

all versions

An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5

8.8HIGH

CVE-2022-23599

< 3.0.6

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContent

4.3MEDIUM

CVE-2021-32806

< 1.2.0

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have

6.5MEDIUM

CVE-2021-35959

>= 5.0 and <= 5.2.4

In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with

5.4MEDIUM

CVE-2021-33513

<= 5.2.4

Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.

5.4MEDIUM

CVE-2021-33512

<= 5.2.4

Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.

5.4MEDIUM

CVE-2021-33511

<= 5.2.4

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.ap

7.5HIGH

CVE-2021-33510

<= 5.2.4

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file

4.3MEDIUM

CVE-2021-33509

<= 5.2.4

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText

9.9CRITICAL

CVE-2021-33508

<= 5.2.4

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.

5.4MEDIUM

CVE-2021-33507

<= 4.3.20

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other produc

6.1MEDIUM

CVE-2021-32633

<= 4.3.20

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectl

6.8MEDIUM

CVE-2021-3313

< 5.2.4

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upl

5.4MEDIUM

CVE-2021-29002

all versions

A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title"

5.4MEDIUM

CVE-2021-21336

>= 4.3.0 and <= 4.3.20

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService bef

6.5MEDIUM

CVE-2020-28736

< 5.2.3

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchem

8.8HIGH

CVE-2020-28735

< 5.2.3

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

8.8HIGH

CVE-2020-28734

< 5.2.3

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

8.8HIGH

CVE-2020-35190

>= 4.0.0-alpine and < 4.3.18-alpine

The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. Syste

9.8CRITICAL

CVE-2020-7941

>= 4.3.0 and <= 5.2.1

A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content wit

9.8CRITICAL

CVE-2020-7940

>= 4.3.0 and <= 5.2.0

Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cra

7.5HIGH

CVE-2020-7939

>= 4.0.0 and <= 5.2.1

SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a

8.8HIGH

CVE-2020-7938

>= 5.2.0 and <= 5.2.1

plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the high

8.8HIGH

CVE-2020-7937

>= 5.0 and <= 5.2.1

An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that w

5.4MEDIUM

CVE-2020-7936

>= 4.0.0 and <= 5.2.1

An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a

6.1MEDIUM

CVE-2013-7062

>= 3.3.0 and <= 3.3.6

Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x thro

6.1MEDIUM

CVE-2017-1000484

all versions

By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this

6.1MEDIUM

CVE-2017-1000483

all versions

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier ho

6.5MEDIUM

CVE-2017-1000482

<= 5.0.9

A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a

5.4MEDIUM

CVE-2017-1000481

all versions

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to th

6.1MEDIUM

CVE-2015-7293

all versions

Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

8.8HIGH

CVE-2015-7318

all versions

Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.

7.5HIGH

CVE-2015-7317

all versions

Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to

6.8MEDIUM

CVE-2015-7316

all versions

Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.

6.1MEDIUM

CVE-2015-7315

all versions

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows

5.9MEDIUM

CVE-2017-5524

all versions

Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitiv

4.3MEDIUM

CVE-2016-7140

all versions

Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, a

6.1MEDIUM

CVE-2016-7139

all versions

Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3

6.1MEDIUM

CVE-2016-7138

all versions

Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, an

6.1MEDIUM

CVE-2016-7137

all versions

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote at

6.1MEDIUM

CVE-2016-7136

all versions

z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attac

6.1MEDIUM

CVE-2016-7135

all versions

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arb

4.9MEDIUM

CVE-2016-4043

all versions

Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging perm

4.9MEDIUM

CVE-2016-4042

all versions

Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.

5.3MEDIUM

CVE-2016-4041

all versions

Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote att

7.3HIGH

CVE-2016-7147

all versions

Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.

6.1MEDIUM

CVE-2012-6661

<= 4.2.2

Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG

CVE-2012-5508

<= 4.2.2

The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG st

CVE-2012-5500

<= 4.2.2

The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change

CVE-2012-5507

<= 4.2.2

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers

CVE-2012-5506

<= 4.2.2

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop)

CVE-2012-5505

<= 4.2.2

atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a vi

CVE-2012-5504

<= 4.2.2

Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attacker

CVE-2012-5503

<= 4.2.2

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

CVE-2012-5502

<= 4.2.2

Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated u

CVE-2012-5501

<= 4.2.2

at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stor

CVE-2012-5499

<= 4.2.2

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consump

CVE-2012-5498

<= 4.2.2

queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of servic

CVE-2012-5497

<= 4.2.2

membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a craft

CVE-2012-5496

<= 3.3.5

kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a cr

CVE-2012-5495

<= 4.2.2

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, re

CVE-2012-5494

<= 4.2.2

Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers

CVE-2012-5493

<= 4.2.2

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Pytho

CVE-2012-5492

<= 4.2.2

uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a c

CVE-2012-5491

<= 4.2.2

z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by

CVE-2012-5490

<= 4.2.2

Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inj

CVE-2012-5489

<= 4.2.2

The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone befor

CVE-2012-5488

<= 4.2.2

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, re

CVE-2012-5487

<= 4.2.2

The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users w

CVE-2012-5486

<= 4.2.2

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to injec

CVE-2012-5485

<= 4.2.2

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified ve

CVE-2013-7061

all versions

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensiti

CVE-2013-7060

all versions

Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors re

CVE-2013-4199

all versions

(1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote auth

CVE-2013-4198

all versions

mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypas

CVE-2013-4197

all versions

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to mod

CVE-2013-4196

all versions

The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does n

CVE-2013-4195

all versions

Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through

CVE-2013-4194

all versions

The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers

CVE-2013-4193

all versions

typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable sett

CVE-2013-4192

all versions

sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails

CVE-2013-4191

all versions

zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when i

CVE-2013-4190

all versions

Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1

CVE-2013-4189

all versions

Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x thro

CVE-2013-4188

all versions

traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator pri

CVE-2013-4200

all versions

The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3

CVE-2011-4462

<= 4.1.3

Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predic

CVE-2011-4030

all versions

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes

CVE-2011-3587

all versions

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remo

CVE-2011-1340

<= 2.5.2

Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote att

CVE-2011-2528

all versions

Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and

CVE-2011-1950

all versions

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecif

CVE-2011-1949

all versions

Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remo

CVE-2011-1948

<= 4.1

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML v

CVE-2011-0720

all versions

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers t

CVE-2010-2422

all versions

Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attac

CVE-2009-0662

all versions

The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which al

CVE-2008-4571

<= 3.0.3

Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrar

CVE-2008-1396

all versions

Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authenticatio

CVE-2008-1395

all versions

Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes i

CVE-2008-1394

<= 2.5.1

Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes

CVE-2008-1393

<= 3

Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for

CVE-2008-0164

all versions

Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrar

CVE-2007-5741

all versions

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing

CVE-2006-4249

all versions

Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to

CVE-2006-4247

all versions

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to res

CVE-2006-1711

all versions

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) te