Ssulu

Products

Exploited and recent CVEs

• CVE-2026-92692 Medium 6.9 Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) 0.4%
• CVE-2026-82396 Medium 5.4 Sulu: Stored XSS via media download inline-disposition override 0.3%
• CVE-2026-82395 Medium 5.3 Sulu: Media move/update authorization bypass (IDOR) 0.4%
• CVE-2026-82394 Medium 5.3 Sulu: Fix authorization bypass when creating preview links 0.6%
• CVE-2026-45701 Medium 6.9 Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens 0.2%
• CVE-2026-34372 Medium 5.3 Sulu checks fix permissions for subentities endpoints 0.3%
• CVE-2025-47778 Medium 6.1 Sulu vulnerable to XXE in SVG File upload Inspector 0.5%
• CVE-2024-47617 Medium 6.1 Reflected XSS Vulnerability in Sulu Media Bundle 0.4%
• CVE-2024-47618 Medium 5.1 Sulu vulnerable to XSS via uploaded SVG 0.4%
• CVE-2024-37156 Medium 6.1 TokenController formName not sanitized in hidden input 0.3%
• CVE-2024-27915 Medium 6.8 Sulu grants access to pages regardless of role permissions 0.4%
• CVE-2024-24807 Low 2.7 Sulu is vulnerable to HTML Injection via Autocomplete Suggestion 0.5%
• CVE-2023-39343 Medium 4.3 Sulu Observable Response Discrepancy on Admin Login 0.6%
• CVE-2021-43836 High 8.5 PHP file inclusion in the Sulu admin panel 2.0%
• CVE-2021-43835 High 7.2 Privilege escalation in the Sulu Admin panel 1.2%
• CVE-2021-41169 Medium 6.2 Improper Neutralization HTML tags in sulu/sulu 0.6%
• CVE-2021-32737 High 8.4 XSS Injection in Media Collection Title was possible 0.7%
• CVE-2020-15132 Medium 5.3 Reset Password / Login vulnerability in Sulu 1.1%