{"kind": "product", "path": "vulns/packagist/sulu%2Fsulu", "name": "sulu/sulu", "product": "sulu/sulu", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-92692", "noindex": false, "published": "2026-09-23T18:19:26.741Z", "modified": "2026-09-23T19:34:45.146Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00418, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-92692", "title": "Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that deg", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-jg26-q8hg-3pq4", "https://github.com/sulu/sulu/commit/d19c01487af8c3de2fb3aa145856707a6367392c", "https://github.com/sulu/sulu/releases/tag/2.6.25"], "fixes": ["2.6.25", "3.0.8"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-82396", "noindex": false, "published": "2026-08-31T21:23:16.852Z", "modified": "2026-09-01T14:29:00.823Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00298, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-82396", "title": "Sulu: Stored XSS via media download inline-disposition override", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disp", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-pp4x-ccxq-6r33", "https://github.com/sulu/sulu/commit/d061094f5b7bb1d5e974544fce30bede9c7adf8e", "https://github.com/sulu/sulu/releases/tag/2.6.25"], "fixes": ["2.6.25", "3.0.8"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-82395", "noindex": false, "published": "2026-08-31T21:20:58.926Z", "modified": "2026-09-01T13:22:32.921Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-82395", "title": "Sulu: Media move/update authorization bypass (IDOR)", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php allows MediaManager::move() to reassign the item without checking that source. An authenticated backend user with edit permission on one collection and knowledge of a target media identifier can name the allowed collection in the request, move an item out of a restricted collection, and then view or download content", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-h6cx-gjxx-v25c", "https://github.com/sulu/sulu/commit/2b959de75d61b98433e42db462c246ed9e4ce793", "https://github.com/sulu/sulu/releases/tag/2.6.25"], "fixes": ["2.6.25", "3.0.8"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-82394", "noindex": false, "published": "2026-08-31T21:17:49.768Z", "modified": "2026-09-02T17:38:08.912Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00576, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-82394", "title": "Sulu: Fix authorization bypass when creating preview links", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in PreviewLinkManager::generate() or PreviewLinkManager::revoke(). An authenticated administration user who knows a target resource identifier can create or revoke a preview link for any page, article, or snippet, including content in a webspace or area the user cannot view. A generated preview URL is public and resolves content by an opaque token, allowing the user or", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-65cv-w493-7vhq", "https://github.com/sulu/sulu/commit/44d8844c3514a70b769ab791b9530df806240fab", "https://github.com/sulu/sulu/releases/tag/2.6.25"], "fixes": ["2.6.25", "3.0.8"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45701", "noindex": false, "published": "2026-06-01T16:09:21.477Z", "modified": "2026-06-01T19:07:13.574Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00232, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45701", "title": "Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.23 and 3.0.6, the password reset tokenand API key generation uses a weak cryptographical hash algorithm. This issue has been patched in versions 2.6.23 and 3.0.6.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-7fv8-6pp7-6h85", "https://github.com/sulu/sulu/releases/tag/2.6.23", "https://github.com/sulu/sulu/releases/tag/3.0.6"], "fixes": ["2.6.23", "3.0.6"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "GHSA-9m6v-8fxc-4r44", "noindex": false, "published": "2026-05-18T17:34:06Z", "modified": "2026-05-18T17:46:18.697711Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-9m6v-8fxc-4r44", "title": "Sulu: Used API Keys may be available via Admin API", "description": "### Impact\n\nThe users endpoint controller exposes a project's apiKey field to the logged-in user, provided they have permission for that endpoint. This only has impact if a project itself uses that specific field, Sulu itself does nothing with it and has no authentication per apiKey in its core.\n\n### Patches\n\nA patch is released with Version 2.6.23 and 3.0.5.\n\n### Workarounds\n\nRemove the field descriptor by patch the UserController.php File in Sulu Security Bundle.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-9m6v-8fxc-4r44", "https://github.com/sulu/sulu", "https://github.com/sulu/sulu/releases/tag/2.6.23"], "fixes": ["2.6.23", "3.0.6"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-34372", "noindex": false, "published": "2026-03-31T20:19:32.601Z", "modified": "2026-03-31T20:29:14.584Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00268, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-34372", "title": "Sulu checks fix permissions for subentities endpoints", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user which has permission for the Sulu Admin via at least one role could have access to the sub-entities of contacts via the admin API without even have permission for contacts. This issue has been patched in versions 2.6.22 and 3.0.5.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-6h7h-m7p5-hjqp", "https://github.com/sulu/sulu/releases/tag/2.6.22", "https://github.com/sulu/sulu/releases/tag/3.0.5"], "fixes": ["2.6.22", "3.0.5"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-47778", "noindex": false, "published": "2025-05-14T15:29:08.187Z", "modified": "2025-05-14T18:13:14.564Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.00469, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-47778", "title": "Sulu vulnerable to XXE in SVG File upload Inspector", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-f6rx-hf55-4255", "https://github.com/sulu/sulu/commit/02f52fca04eb9495b9b4a0c5cc64cf23bc27f544", "https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php"], "fixes": ["2.5.25", "2.6.9", "3.0.0-alpha3"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-47617", "noindex": false, "published": "2024-10-03T14:24:44.300Z", "modified": "2024-10-08T13:33:43.219Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00397, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-47617", "title": "Reflected XSS Vulnerability in Sulu Media Bundle", "description": "Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85", "https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda", "https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29"], "fixes": ["2.5.21", "2.6.5"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-47618", "noindex": false, "published": "2024-10-03T14:18:02.129Z", "modified": "2024-10-18T14:42:45.592Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.0035, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-47618", "title": "Sulu vulnerable to XSS via uploaded SVG", "description": "Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers. This issue is fixed in 2.6.5.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-255w-87rh-rg44", "https://github.com/sulu/sulu/commit/ca72f75eebe41ea7726624d8aea7da6c425f1eb9", "https://nvd.nist.gov/vuln/detail/CVE-2024-47618"], "fixes": ["2.5.21", "2.6.5"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-27915", "noindex": false, "published": "2024-03-06T19:33:11.798Z", "modified": "2025-04-16T15:54:40.497Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.0045, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-27915", "title": "Sulu grants access to pages regardless of role permissions", "description": "Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p", "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da", "https://nvd.nist.gov/vuln/detail/CVE-2024-27915"], "fixes": ["2.4.17", "2.5.13"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-24807", "noindex": false, "published": "2024-02-05T20:09:36.891Z", "modified": "2024-08-01T23:28:12.885Z", "cvss": 2.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00518, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-24807", "title": "Sulu is vulnerable to HTML Injection via Autocomplete Suggestion", "description": "Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones affected. The problem is patched with version(s) 2.4.16 and 2.5.12.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-gfrh-gwqc-63cv", "https://github.com/sulu/sulu/releases/tag/2.4.16", "https://github.com/sulu/sulu/releases/tag/2.5.12"], "fixes": ["2.4.16", "2.5.12"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-39343", "noindex": false, "published": "2023-08-04T00:06:29.997Z", "modified": "2024-10-03T18:21:46.144Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00622, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-39343", "title": "Sulu Observable Response Discrepancy on Admin Login", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by this Security issue. The vulnerability has been patched in version 2.5.10. \n\n", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-wmwf-49vv-p3mr", "https://github.com/sulu/sulu/commit/5f6c98ba030b2005793e2dc647cc938937ea889b", "https://github.com/sulu/sulu/releases/tag/2.5.10"], "fixes": ["2.5.10"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2021-43836", "noindex": false, "published": "2021-12-15T20:10:10.000Z", "modified": "2024-08-04T04:10:16.325Z", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.02047, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2021-43836", "title": "PHP file inclusion in the Sulu admin panel", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-vx6j-pjrh-vgjh", "https://github.com/sulu/sulu/commit/9c948f9ce350c68b53af8c3910e2cefc7f722b54", "https://nvd.nist.gov/vuln/detail/CVE-2021-43836"], "fixes": ["1.6.44", "2.2.18", "2.3.8", "2.4.0"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2021-43835", "noindex": false, "published": "2021-12-15T20:00:16.000Z", "modified": "2024-08-04T04:10:15.699Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01172, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2021-43835", "title": "Privilege escalation in the Sulu Admin panel", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction. The versions have been patched in 2.2.18, 2.3.8 and 2.4.0. For users unable to upgrade the only known workaround is to apply a patch to the ProfileController manually.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-84px-q68r-2fc9", "https://github.com/sulu/sulu/commit/30bf8b5a4f83b6f2171a696011757d095edaa28a", "https://nvd.nist.gov/vuln/detail/CVE-2021-43835"], "fixes": ["2.2.18", "2.3.8", "2.4.0"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2021-41169", "noindex": false, "published": "2021-10-21T20:25:10.000Z", "modified": "2024-08-04T02:59:31.756Z", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00591, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2021-41169", "title": "Improper Neutralization HTML tags in sulu/sulu", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-h58v-g3q6-q9fx", "https://github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445", "https://nvd.nist.gov/vuln/detail/CVE-2021-41169"], "fixes": ["1.6.43"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2021-32737", "noindex": false, "published": "2021-07-02T17:55:09.000Z", "modified": "2024-08-03T23:33:55.802Z", "cvss": 8.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00665, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2021-32737", "title": "XSS Injection in Media Collection Title was possible", "description": "Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-gm2x-6475-g9r8", "https://github.com/sulu/sulu/releases/tag/1.6.41", "https://nvd.nist.gov/vuln/detail/CVE-2021-32737"], "fixes": ["1.6.41"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}, {"id": "CVE-2020-15132", "noindex": false, "published": "2020-08-05T20:30:13.000Z", "modified": "2024-08-04T13:08:22.435Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.01112, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2020-15132", "title": "Reset Password / Login vulnerability in Sulu", "description": "In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the \"Forget password\" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that this user name does not exist. This enables attackers to retrieve valid usernames. Also, the response of the \"Forgot Password\" request returns the email address to which the email was sent, if the operation was successful. This information should not be exposed, as it can be used to gather email addresses. This problem was fixed in versions 1.6.35, 2.0.10 and ", "references": ["https://github.com/sulu/sulu/security/advisories/GHSA-wfm4-pq59-wg6r", "https://nvd.nist.gov/vuln/detail/CVE-2020-15132"], "fixes": ["1.6.34", "2.0.10", "2.1.1"], "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}, {"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}]}], "total": 18, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "sulu/sulu", "path": "vulns/packagist/sulu%2Fsulu", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-23T19:34:45.146Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}