Skip to content
Noroxi

plone records

116 published records for vendor plone.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 0.9%
Pre-auth RCE
7
With a fix record
92.2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

116 records
  • CVE-2011-3587
    60This week

    Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attacke

    CriticalCVSS 9.3WeaponizedEPSS 78%

    plone · ploneOct 10, 2011

  • CVE-2008-1393
    41Plan

    Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin

    CriticalCVSS 10.0No exploitEPSS 3%

    plone · plone cmsMar 19, 2008

  • CVE-2020-7941
    40Plan

    A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needi

    CriticalCVSS 9.8No exploitEPSS 2%

    plone · ploneJan 23, 2020

  • CVE-2020-35190
    40Plan

    The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user.

    CriticalCVSS 9.8No exploitEPSS 2%

    plone · ploneDec 16, 2020

  • CVE-2021-33509
    40Plan

    Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform

    CriticalCVSS 9.9No exploitEPSS 2%

    plone · ploneMay 21, 2021

  • CVE-2024-23054
    39Monitor

    An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package liste

    CriticalCVSS 9.8No exploitEPSS 1%

    plone · plone docker official imageFeb 5, 2024

  • CVE-2011-4030
    38Monitor

    The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from bein

    CriticalCVSS 9.3No exploitEPSS 2%

    plone · cmfeditionsOct 10, 2011

  • CVE-2015-7293
    36Monitor

    Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

    HighCVSS 8.8Proof of conceptEPSS 3%

    plone · ploneSep 25, 2017

  • CVE-2021-32633
    36Monitor

    Remote Code Execution via traversal in TAL expressions

    HighCVSS 8.8No exploitEPSS 2%

    zope · zopeMay 21, 2021

  • CVE-2012-5487
    35Monitor

    The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certai

    HighCVSS 8.5No exploitEPSS 2%

    plone · ploneSep 30, 2014

  • CVE-2012-5493
    35Monitor

    gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox

    HighCVSS 8.5No exploitEPSS 2%

    plone · ploneSep 30, 2014

  • CVE-2020-7938
    35Monitor

    plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.

    HighCVSS 8.8No exploitEPSS 1%

    plone · ploneJan 23, 2020

  • CVE-2020-28735
    35Monitor

    Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

    HighCVSS 8.8No exploitEPSS 1%

    plone · ploneDec 30, 2020

  • CVE-2020-28736
    35Monitor

    Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (there

    HighCVSS 8.8No exploitEPSS 1%

    plone · ploneDec 30, 2020

  • CVE-2020-28734
    35Monitor

    Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

    HighCVSS 8.8No exploitEPSS 1%

    plone · ploneDec 30, 2020

  • CVE-2020-7939
    35Monitor

    SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries.

    HighCVSS 8.8No exploitEPSS 1%

    plone · ploneJan 23, 2020

  • CVE-2021-33926
    35Monitor

    An issue in Plone CMS v.

    HighCVSS 8.8No exploitEPSS 1%

    plone · ploneFeb 17, 2023

  • CVE-2011-0720
    31Monitor

    Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain a

    HighCVSS 7.5No exploitEPSS 3%

    plone · ploneFeb 3, 2011

  • CVE-2007-5741
    31Monitor

    Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled o

    HighCVSS 7.5No exploitEPSS 2%

    plone · ploneNov 7, 2007

  • CVE-2011-2528
    31Monitor

    Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) Plone

    HighCVSS 7.5No exploitEPSS 2%

    plone · plone hotfix 20110720Jul 19, 2011

  • CVE-2015-7318
    31Monitor

    Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.

    HighCVSS 7.5No exploitEPSS 2%

    plone · ploneSep 25, 2017

  • CVE-2008-1394
    30Monitor

    Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier

    HighCVSS 7.5No exploitEPSS 1%

    plone · plone cmsMar 19, 2008

  • CVE-2008-1395
    30Monitor

    Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier f

    HighCVSS 7.5No exploitEPSS 1%

    plone · plone cmsMar 19, 2008

  • CVE-2020-7940
    30Monitor

    Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.

    HighCVSS 7.5No exploitEPSS 1%

    plone · ploneJan 23, 2020

  • CVE-2021-33511
    30Monitor

    Plone though 5.2.4 allows SSRF via the lxml parser.

    HighCVSS 7.5No exploitEPSS 1%

    plone · ploneMay 21, 2021