Plone
123 CVEs across 18 Plone products. Browse Plone vulnerabilities, severities, and proof-of-concept exploits.
Plone products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57576 | Medium | 6.5 | 2026-09-22 | plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types… |
CVE-2026-57149 | Critical | 9.9 | 2026-09-22 | plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting i… |
CVE-2026-54503 | Medium | 4.3 | 2026-09-15 | plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, dep… |
CVE-2026-55248 | Critical | 9.1 | 2026-08-28 | plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS port… |
CVE-2026-55247 | Critical | 9.1 | 2026-08-28 | plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py acce… |
CVE-2026-28413 | Medium | 5.3 | 2026-03-05 | Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example m… |
CVE-2025-61668 | | 2025-10-02 | Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0… | |
CVE-2025-58047 | High | 7.5 | 2025-08-28 | Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17… |
CVE-2024-22889 | High | 7.5 | 2024-03-06 | Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request. |
CVE-2024-23756 | High | 7.5 | 2024-02-08 | The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions… |
CVE-2024-23054 | Critical | 9.8 | 2024-02-05 | An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++stati… |
CVE-2024-23055 | Medium | 6.1 | 2024-01-25 | An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST header… |
CVE-2024-0669 | Medium | 6.3 | 2024-01-18 | A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an ad… |
CVE-2023-42457 | High | 7.5 | 2023-09-21 | plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when… |
CVE-2023-41048 | Low | 3.7 | 2023-09-21 | plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1… |
CVE-2021-33926 | High | 8.8 | 2023-02-17 | An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5… |
CVE-2022-24740 | Medium | 5.0 | 2022-03-14 | Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authenti… |
CVE-2022-23599 | Medium | 4.3 | 2022-01-28 | Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6… |
CVE-2021-32806 | Medium | 6.5 | 2021-08-02 | Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerabilit… |
CVE-2021-35959 | Medium | 5.4 | 2021-06-30 | In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the descripti… |
CVE-2021-33513 | Medium | 5.4 | 2021-05-21 | Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. |
CVE-2021-33512 | Medium | 5.4 | 2021-05-21 | Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. |
CVE-2021-33511 | High | 7.5 | 2021-05-21 | Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterit… |
CVE-2021-33510 | Medium | 4.3 | 2021-05-21 | Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file. |
CVE-2021-33509 | Critical | 9.9 | 2021-05-21 | Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. |
CVE-2021-33508 | Medium | 5.4 | 2021-05-21 | Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item. |
CVE-2021-33507 | Medium | 6.1 | 2021-05-21 | Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS. |
CVE-2021-32633 | Medium | 6.8 | 2021-05-21 | Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that… |
CVE-2021-3313 | Medium | 5.4 | 2021-05-20 | Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's… |
CVE-2021-29002 | Medium | 5.4 | 2021-03-24 | A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter. |
CVE-2021-21336 | Medium | 6.5 | 2021-03-08 | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an… |
CVE-2020-28736 | High | 8.8 | 2020-12-30 | Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only availabl… |
CVE-2020-28735 | High | 8.8 | 2020-12-30 | Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). |
CVE-2020-28734 | High | 8.8 | 2020-12-30 | Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. |
CVE-2020-35190 | Critical | 9.8 | 2020-12-17 | The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker cont… |
CVE-2020-7941 | Critical | 9.8 | 2020-01-23 | A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission. |
CVE-2020-7940 | High | 7.5 | 2020-01-23 | Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. |
CVE-2020-7939 | High | 8.8 | 2020-01-23 | SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.) |
CVE-2020-7938 | High | 8.8 | 2020-01-23 | plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level. |
CVE-2020-7937 | Medium | 5.4 | 2020-01-23 | An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other us… |
CVE-2020-7936 | Medium | 6.1 | 2020-01-23 | An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followe… |
CVE-2013-7062 | Medium | 6.1 | 2020-01-02 | Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2… |
CVE-2017-1000484 | Medium | 6.1 | 2018-01-03 | By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker c… |
CVE-2017-1000483 | Medium | 6.5 | 2018-01-03 | Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method… |
CVE-2017-1000482 | Medium | 5.4 | 2018-01-03 | A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page… |
CVE-2017-1000481 | Medium | 6.1 | 2018-01-03 | When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you log… |
CVE-2015-7293 | High | 8.8 | 2017-09-25 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. |
CVE-2015-7318 | High | 7.5 | 2017-09-25 | Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses. |
CVE-2015-7317 | Medium | 6.8 | 2017-09-25 | Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings. |
CVE-2015-7316 | Medium | 6.1 | 2017-09-25 | Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and… |
CVE-2015-7315 | Medium | 5.9 | 2017-09-25 | Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new… |
CVE-2017-5524 | Medium | 4.3 | 2017-03-23 | Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging t… |
CVE-2016-7140 | Medium | 6.1 | 2017-03-07 | Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow… |
CVE-2016-7139 | Medium | 6.1 | 2017-03-07 | Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows rem… |
CVE-2016-7138 | Medium | 6.1 | 2017-03-07 | Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows… |
CVE-2016-7137 | Medium | 6.1 | 2017-03-07 | Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to… |
CVE-2016-7136 | Medium | 6.1 | 2017-03-07 | z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request. |
CVE-2016-7135 | Medium | 4.9 | 2017-03-07 | Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot do… |
CVE-2016-4043 | Medium | 4.9 | 2017-02-24 | Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit tem… |
CVE-2016-4042 | Medium | 5.3 | 2017-02-24 | Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors. |
CVE-2016-4041 | High | 7.3 | 2017-02-24 | Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access… |
CVE-2016-7147 | Medium | 6.1 | 2017-02-04 | Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allow… |
CVE-2012-6661 | | 2014-11-03 | Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for… | |
CVE-2012-5508 | | 2014-11-03 | The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via u… | |
CVE-2012-5500 | | 2014-11-03 | The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items… | |
CVE-2012-5507 | | 2014-09-30 | AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vect… | |
CVE-2012-5506 | | 2014-09-30 | python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RSS feed request for… | |
CVE-2012-5505 | | 2014-09-30 | atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name. | |
CVE-2012-5504 | | 2014-09-30 | Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web scr… | |
CVE-2012-5503 | | 2014-09-30 | ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors. | |
CVE-2012-5502 | | 2014-09-30 | Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit… | |
CVE-2012-5501 | | 2014-09-30 | at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types vi… | |
CVE-2012-5499 | | 2014-09-30 | python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, rela… | |
CVE-2012-5498 | | 2014-09-30 | queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a… | |
CVE-2012-5497 | | 2014-09-30 | membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL. | |
CVE-2012-5496 | | 2014-09-30 | kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL. | |
CVE-2012-5495 | | 2014-09-30 | python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back." | |
CVE-2012-5494 | | 2014-09-30 | Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web scrip… | |
CVE-2012-5493 | | 2014-09-30 | gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitra… | |
CVE-2012-5492 | | 2014-09-30 | uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL. | |
CVE-2012-5491 | | 2014-09-30 | z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the f… | |
CVE-2012-5490 | | 2014-09-30 | Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or H… | |
CVE-2012-5489 | | 2014-09-30 | The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1… | |
CVE-2012-5488 | | 2014-09-30 | python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject. | |
CVE-2012-5487 | | 2014-09-30 | The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to byp… | |
CVE-2012-5486 | | 2014-09-30 | ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via… | |
CVE-2012-5485 | | 2014-09-30 | registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin i… | |
CVE-2013-7061 | | 2014-05-02 | Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspeci… | |
CVE-2013-7060 | | 2014-05-02 | Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for un… | |
CVE-2013-4199 | | 2014-03-11 | (1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a de… | |
CVE-2013-4198 | | 2014-03-11 | mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password… | |
CVE-2013-4197 | | 2014-03-11 | member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of ot… | |
CVE-2013-4196 | | 2014-03-11 | The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access t… | |
CVE-2013-4195 | | 2014-03-11 | Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, an… | |
CVE-2013-4194 | | 2014-03-11 | The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive informati… | |
CVE-2013-4193 | | 2014-03-11 | typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content ed… | |
CVE-2013-4192 | | 2014-03-11 | sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors. | |
CVE-2013-4191 | | 2014-03-11 | zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip arc… | |
CVE-2013-4190 | | 2014-03-11 | Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4… | |
CVE-2013-4189 | | 2014-03-11 | Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through… |