silverstripe
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| silverstripe-framework | 7 | – | Jul 1, 2026 |
| silverstripe-graphql | 3 | – | Jan 23, 2024 |
| silverstripe-asset-admin | 1 | – | Jan 14, 2025 |
| silverstripe-assets | 1 | – | Apr 16, 2026 |
| silverstripe-cms | 1 | – | Aug 6, 2026 |
| silverstripe-elemental | 1 | – | Apr 10, 2025 |
| silverstripe-mfa | 1 | – | Nov 3, 2026 |
| silverstripe-omnipay | 1 | – | Jun 6, 2022 |
| silverstripe-reports | 1 | – | Jul 17, 2024 |
| silverstripe-userforms | 1 | – | Aug 27, 2026 |
| silverstripe-admin | 1 | – | Jan 23, 2024 |
| silverstripe-versioned | 1 | – | Aug 28, 2026 |
| silverstripe-advancedworkflow | 1 | – | Aug 27, 2026 |
Exploited and recent CVEs
- CVE-2026-55186 Silverstripe MFA: Can bypass MFA during password reset flow 0.3%
- CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore 0.3%
- CVE-2026-54718 Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template 1.0%
- CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject 0.7%
- CVE-2026-54717 Silverstripe: XSS in breadcrumbs in page list view 0.3%
- CVE-2026-54720 Silverstripe Framework: Possible XSS attack through media embed 0.3%
- CVE-2026-24749 Silverstripe Assets Module has a DBFile::getURL() permission bypass 0.4%
- CVE-2025-30148 Silverstripe Framework has a XSS vulnerability in HTML editor 0.3%
- CVE-2025-25197 Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports 0.3%
- CVE-2024-53277 Cross-site Scripting in form messages in silverstripe framework 0.3%
- CVE-2024-47605 Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin 1.2%
- CVE-2024-32981 Cross-site Scripting vulnerability with encoded payload in silverstripe/framework 0.3%
- CVE-2024-29885 Reports are still accessible even when `canView()` returns false in silverstripe/reports 0.4%
- CVE-2023-49783 No permission checks for editing/deleting records with CSV import form 0.3%
- CVE-2023-48714 Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter 0.4%
- CVE-2023-44401 Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data 0.4%
- CVE-2023-40180 Denial of service vulnerability in silverstripe-graphql via recursive queries 1.1%
- CVE-2023-22729 Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen 0.4%
- CVE-2023-22728 Silverstripe Framework has missing permission check of canView in GridFieldPrintButton 0.5%
- CVE-2023-28104 silverstripe/graphql Denial of Service vulnerability 1.1%
- CVE-2022-29254 Failed payment recorded has completed in silverstripe/silverstripe-omnipay 0.7%