Orchardcore

10 CVEs across 5 Orchardcore products. Browse Orchardcore vulnerabilities, severities, and proof-of-concept exploits.

Orchardcore products with known CVEs

ProductCVEs
Orchardcore7
Orchard Cms1
Orchard Core1
Orchard Core1
Users1
Orchardcore CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2020-37019Medium6.42026-01-30Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation…
CVE-2022-37720Critical9.02022-11-25Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted htm…
CVE-2022-32173Medium5.42022-10-03In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dia…
CVE-2022-0822Medium5.42022-03-11Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVE-2022-0821Medium6.52022-03-11Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVE-2022-0820Medium6.12022-03-11Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVE-2022-0243Medium5.42022-01-19Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
CVE-2022-0274Medium5.42022-01-19Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
CVE-2022-0159Medium5.42022-01-12orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-25966High8.82021-10-10In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password…