Skip to content
Noroxi

apostrophecms records

17 published records for vendor apostrophecms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
100%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20
  2. 21
  3. 22
  4. 24
  5. 25
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

17 records
  • CVE-2021-25979
    39Monitor

    Apostrophe - Insufficient Session Expiration

    CriticalCVSS 9.8No exploitEPSS 1%

    apostrophecms · apostrophecmsNov 8, 2021

  • CVE-2026-32731
    39Monitor

    ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

    CriticalCVSS 9.9Proof of conceptEPSS 1%

    apostrophecms · import-exportMar 18, 2026

  • CVE-2026-35569
    34Monitor

    ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS

    HighCVSS 8.7No exploitEPSS 0%

    apostrophecms · apostrophecmsApr 15, 2026

  • CVE-2026-32730
    32Monitor

    ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

    HighCVSS 8.1No exploitEPSS 0%

    apostrophecms · apostrophecmsMar 18, 2026

  • CVE-2022-25887
    30Monitor

    Regular Expression Denial of Service (ReDoS)

    HighCVSS 7.5No exploitEPSS 1%

    apostrophecms · sanitize-htmlAug 30, 2022

  • CVE-2016-1000237
    24Monitor

    sanitize-html before 1.4.3 has XSS.

    MediumCVSS 6.1No exploitEPSS 1%

    apostrophecms · sanitize-htmlJan 23, 2020

  • CVE-2026-40186
    24Monitor

    ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

    MediumCVSS 6.1No exploitEPSS 0%

    apostrophecms · apostrophecmsApr 15, 2026

  • CVE-2014-125128
    24Monitor

    'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS).

    MediumCVSS 6.1No exploitEPSS 0%

    apostrophecms · sanitize-htmlSep 8, 2025

  • CVE-2019-25225
    24Monitor

    `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS).

    MediumCVSS 6.1No exploitEPSS 0%

    apostrophecms · sanitize-htmlSep 8, 2025

  • CVE-2021-26539
    22Monitor

    Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacke

    MediumCVSS 5.3No exploitEPSS 2%

    apostrophecms · sanitize-htmlFeb 8, 2021

  • CVE-2021-26540
    22Monitor

    Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when

    MediumCVSS 5.3No exploitEPSS 2%

    apostrophecms · sanitize-htmlFeb 8, 2021

  • CVE-2024-21501
    21Monitor

    Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attri

    MediumCVSS 5.3No exploitEPSS 1%

    apostrophecms · sanitize-htmlFeb 24, 2024

  • CVE-2026-33888
    21Monitor

    ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API

    MediumCVSS 5.3No exploitEPSS 1%

    apostrophecms · apostrophecmsApr 15, 2026

  • CVE-2021-25978
    21Monitor

    Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious Jav

    MediumCVSS 5.4No exploitEPSS 0%

    apostrophecms · apostrophecmsNov 7, 2021

  • CVE-2026-39857
    21Monitor

    Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions

    MediumCVSS 5.3No exploitEPSS 0%

    apostrophecms · apostrophecmsApr 15, 2026

  • CVE-2026-33889
    21Monitor

    ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context

    MediumCVSS 5.4No exploitEPSS 0%

    apostrophecms · apostrophecmsApr 15, 2026

  • CVE-2026-33877
    14Monitor

    ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint

    LowCVSS 3.7No exploitEPSS 0%

    apostrophecms · apostrophecmsApr 15, 2026