Is plone safe ? 100 known vulnerabilities, worst severity CRITICAL.
// reach 11 direct dependencies
3 carry known advisories, worst HIGH
13 packages depend on it
an advisory here reaches each of them
// ai model usage No published models are known to use this package.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 83rd percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-w6g9-xccc-347h, the advisory selected below
// 100 advisories GHSA-w6g9-xccc-347h A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission. CRIT GHSA-w6pw-5gh5-4952 python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back." CRIT GHSA-3v28-9jjp-4g5w Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors. CRIT GHSA-hf26-vvmx-x8c8 Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes. CRIT GHSA-hm2p-fhwx-9285 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. CRIT GHSA-5xfx-55x4-j223 A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element. HIGH GHSA-47p5-p3jw-w78w An issue in Plone CMS allows attacker to access sensitive information via the RSS feed protlet. HIGH GHSA-cjg3-q24h-9qwf plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level. HIGH GHSA-hhmf-7rgg-gcw5 SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.) HIGH GHSA-cw58-gpgw-hwx2 Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. HIGH Show all 100 advisories A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High Checked 2026-11-06 at 23:52 UTC. The most recent advisory here was published 2024-03-06. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page