Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
In ApostropheCMS prior to 4.34.0, a REST endpoint bypasses page and field access controls, allowing editor-level users to view restricted pages and fields if they know the document identifier.
A missing authentication check in ApostropheCMS allows unauthenticated users with a standard CSRF cookie to trigger cleanup operations and delete temporary export files, as well as modify job records in the database.
A vulnerability in ApostropheCMS allows any authenticated user to enumerate slugs across the system via the doc/slugTaken endpoint, exposing the existence of private, draft, and administrative content.
ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.
A stored cross-site scripting vulnerability in ApostropheCMS allows authenticated users with edit permissions to inject arbitrary HTML and JavaScript via trailing content in color fields. Upgrading to version 4.34.0 or later mitigates this issue.
A vulnerability in ApostropheCMS allows the import API to bypass publication roles, enabling users with edit-only permissions to create, replace, or delete published content without required publishing authority.
A vulnerability in ApostropheCMS allows authenticated users to exhaust server storage during archive extraction due to missing decompression quotas and failure cleanup, potentially causing a denial of service.
In @apostrophecms/import-export, the overrideDuplicates continuation accepts client-supplied replacement choices, allowing contributors to overwrite published content without publication authority.
An unauthenticated resource exhaustion vulnerability in ApostropheCMS allows remote attackers to trigger large chunked upload processing and cleanup operations without authentication, potentially leading to denial of service.
ApostropheCMS notification endpoints fail to verify authentication or ownership. An unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notifications.
A vulnerability in ApostropheCMS allows the general public to access user objects through relationships if templates expose them, as viewRole is not enforced for unauthenticated public users.
An authorization bypass in the ApostropheCMS page REST API allows unauthenticated visitors and low-privileged contributors to read restricted page content and site structure metadata.
A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.
A client-side prototype pollution vulnerability in ApostropheCMS allows attackers to execute arbitrary JavaScript in the context of an authenticated user session if the victim visits a crafted link, potentially leading to unauthorized data access and administrative compromise.
A lack of attempt throttling on ApostropheCMS's authenticated password-change endpoint allows attackers with an active session to repeatedly guess the current password without lockout or rate limiting, potentially enabling account takeover if the password is weak.
In ApostropheCMS before 4.33.0, the exist-in-locale API allows authenticated low-privilege users to determine whether restricted documents and drafts exist and retrieve localized identifiers without proper document-level authorization checks.
A namespace prefix bypass in sanitize-html allows SVG SMIL animation elements to evade URL sink restrictions, potentially enabling cross-site scripting attacks when SVG elements are allowed.
ApostropheCMS uploadfs with the Azure backend and SAS enabled inadvertently exposes container-level SAS tokens in public attachment links. This allows unauthenticated users to read, overwrite, delete, or list blobs stored in the container.
In @apostrophecms/ai-helper, an authenticated editor can supply a crafted Host header to control the server-side image fetch origin, enabling SSRF against internal hosts and ports.
A NoSQL injection vulnerability in the ApostropheCMS import-export module allows authenticated users to match and overwrite unintended documents using crafted update-key values.
An authorization omission in ApostropheCMS allows unauthenticated remote callers knowing a document identifier to verify document existence and retrieve locale publication metadata.
Unauthenticated CSV import requests in ApostropheCMS leave rejected uploaded files in the operating system temporary directory. Remote attackers can exploit this behavior by repeatedly submitting large files, exhausting available disk space and causing a denial of service across host services.
ApostropheCMS packages interpolate user-supplied CAPTCHA tokens without URL encoding into outbound verification requests. Attackers can inject query parameters to cause verification failures and disrupt protected login and form workflows.
Unauthenticated attackers can stream unbounded multipart request bodies to disk via form submission endpoints in ApostropheCMS, leading to disk space exhaustion and a denial-of-service condition.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.