Six Apart Ltd.
37 CVEs across 28 Six Apart Ltd. products. Browse Six Apart Ltd. vulnerabilities, severities, and proof-of-concept exploits.
Six Apart Ltd. products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44392 | Medium | 4.3 | 2026-05-20 | Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, uni… |
CVE-2026-33088 | Critical | 9.8 | 2026-04-08 | Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement. |
CVE-2026-25776 | Critical | 9.8 | 2026-04-08 | Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script. |
CVE-2026-24447 | Medium | 6.5 | 2026-02-04 | If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user downl… |
CVE-2026-23704 | Medium | 6.5 | 2026-02-04 | A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the admin… |
CVE-2026-22875 | Medium | 5.4 | 2026-02-04 | Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed… |
CVE-2026-21393 | Medium | 5.4 | 2026-02-04 | Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed… |
CVE-2025-62499 | Medium | 4.8 | 2025-10-23 | Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "Cont… |
CVE-2025-54856 | Medium | 4.8 | 2025-10-23 | Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Managem… |
CVE-2025-55706 | Medium | 4.3 | 2025-08-20 | URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted int… |
CVE-2025-53522 | Medium | 5.3 | 2025-08-20 | Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attack… |
CVE-2025-25054 | Medium | 6.1 | 2025-02-19 | Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and… |
CVE-2025-24841 | Medium | 5.4 | 2025-02-19 | Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich t… |
CVE-2025-22888 | Medium | 5.4 | 2025-02-19 | Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be ex… |
CVE-2023-45746 | Medium | 5.4 | 2023-10-30 | Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are… |
CVE-2022-45122 | Medium | 6.1 | 2022-12-07 | Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movab… |
CVE-2022-45113 | Medium | 6.5 | 2022-12-07 | Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a r… |
CVE-2022-43660 | High | 7.2 | 2022-12-07 | Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage… |
CVE-2022-38078 | Critical | 9.8 | 2022-08-24 | Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Ty… |
CVE-2020-5669 | Medium | 5.4 | 2021-10-26 | Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote aut… |
CVE-2021-20837 | Critical | 9.8 | 2021-10-26 | Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (… |
CVE-2021-20815 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 an… |
CVE-2021-20814 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type… |
CVE-2021-20813 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) and Movable Type A… |
CVE-2021-20812 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series… |
CVE-2021-20811 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and… |
CVE-2021-20810 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0… |
CVE-2021-20809 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series… |
CVE-2021-20808 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier… |
CVE-2021-20665 | Medium | 6.1 | 2021-03-05 | Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced… |
CVE-2021-20664 | Medium | 6.1 | 2021-03-05 | Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705… |
CVE-2021-20663 | Medium | 6.1 | 2021-03-05 | Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r… |
CVE-2020-5577 | High | 8.8 | 2020-05-14 | Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7)… |
CVE-2020-5576 | High | 8.8 | 2020-05-14 | Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4… |
CVE-2020-5575 | Medium | 6.1 | 2020-05-14 | Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) a… |
CVE-2020-5574 | Medium | 5.3 | 2020-05-14 | HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606… |
CVE-2018-0672 | Medium | 6.1 | 2018-09-04 | Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified… |