The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
pypi package report
Is products-plonepas safe?
1 known vulnerability, worst severity MODERATE.
// reach
15 direct dependencies
5 carry known advisories, worst CRITICAL
Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage
No published models are known to use this package.
cvss
0.0
medium
severity band, no base score published
epss
0.00%
medium
chance of exploitation in 30 days, 62nd percentile of all CVEs
xyz score
not scored
CyberXYZ composite out of 10
fig. 01 — GHSA-pq3x-96c3-xgjg, the advisory selected below
// 1 advisories
Checked 2026-10-23 at 18:54 UTC. The most recent advisory here was published 2018-07-23. Updated continuously from NVD, GHSA, OSV and CNA feeds.