CVE-2026-53698 | Medium | 6.5 | 2026-06-10 | Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set. |
CVE-2025-46047 | Medium | 6.5 | 2025-09-02 | A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid us… |
CVE-2025-45055 | Medium | 5.4 | 2025-06-09 | Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An authenticated user can upload a malicious SVG fi… |
CVE-2024-56923 | Medium | 5.4 | 2025-01-22 | Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remot… |
CVE-2024-48814 | High | 7.5 | 2025-01-03 | SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the findbywhereclause fu… |
CVE-2024-42850 | Critical | 9.8 | 2024-08-16 | An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. |
CVE-2024-42849 | Medium | 6.5 | 2024-08-16 | An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function. |
CVE-2024-39031 | Medium | 5.4 | 2024-07-09 | In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same d… |
CVE-2024-36042 | Critical | 9.8 | 2024-06-03 | Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with supe… |
CVE-2024-29392 | Medium | 5.4 | 2024-05-22 | Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController. |
CVE-2023-47327 | Medium | 4.3 | 2023-12-13 | The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any aut… |
CVE-2023-47326 | High | 8.8 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function. |
CVE-2023-47325 | Medium | 5.4 | 2023-12-13 | Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, re… |
CVE-2023-47324 | Medium | 5.4 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. |
CVE-2023-47323 | High | 7.5 | 2023-12-13 | The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages s… |
CVE-2023-47322 | High | 8.8 | 2023-12-13 | The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes… |
CVE-2023-47321 | Medium | 4.9 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. |
CVE-2023-47320 | High | 8.1 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting… |
CVE-2018-19586 | Critical | 9.9 | 2019-04-09 | Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/u… |