Silverstripe/framework

This hub aggregates every CVE we track for Silverstripe/framework, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Silverstripe/framework.

• GHSA-256q-hx8w-xcqxSilverstripe Framework user enumeration via timing attack on login and password reset formsApr 10, 2025
• CVE-2025-30148Silverstripe Framework has a XSS vulnerability in HTML editor5.4Apr 10, 2025
• GHSA-74j9-xhqr-6qv3Reflected Cross Site Scripting (XSS) in error messageJan 23, 2025
• CVE-2024-53277Cross-site Scripting in form messages in silverstripe framework5.4Jan 14, 2025
• CVE-2024-47605Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin5.4Jan 14, 2025
• GHSA-mqf3-qpc3-g26qSilverstripe Framework has a Reflected Cross Site Scripting (XSS) in error messageJan 14, 2025
• CVE-2024-32981Cross-site Scripting vulnerability with encoded payload in silverstripe/framework5.4Jul 17, 2024
• GHSA-52cw-pvq9-9m5vSilverstripe uses TinyMCE which allows svg files linked in object tagsJul 17, 2024
• GHSA-265q-222x-52m6silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connectorMay 28, 2024
• GHSA-cwgq-83w5-8jfqsilverstripe/framework has possible denial of service attack vector when flushingMay 28, 2024
• GHSA-m2hh-2m46-x6j5silverstripe/framework may disclose database credentials during connection failureMay 28, 2024
• GHSA-vcg6-8fxc-x5cqsilverstripe/framework allows upload of dangerous file typesMay 27, 2024
• GHSA-crr3-h4m8-7f56silverstripe/framework vulnerable to member disclosure in login formMay 27, 2024
• GHSA-vh7q-j8p5-2h4hsilverstripe/framework sends passwords back to browsers under some circumstancesMay 27, 2024
• GHSA-f43j-8hq4-2xj9silverstripe/framework uploaded PHP script execution in assetsMay 27, 2024