Vulnerabilidades em apostrophecms
56 resultadosAnálise Vexday
ApostropheCMS apresenta 18 vulnerabilidades catalogadas, com 10 delas publicadas nos últimos 90 dias, indicando atividade recente significativa. Embora nenhuma vulnerabilidade esteja sob exploração ativa confirmada (KEV), 3 são críticas e a fraqueza dominante é XSS (CWE-79), típica de plataformas de conteúdo, representando risco de comprometimento de sessões e dados de usuários. A cadência elevada de descobertas recentes recomenda monitoramento contínuo e aplicação de patches prioritários nas versões em produção.
CVE-2026-44990CRITICALApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`EPSS 0.7%CVE-2026-113658HIGHApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryEPSS 0.6%CVE-2026-113711HIGHApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportEPSS 0.6%CVE-2026-112953MEDIUMApostropheCMS: Exposure of Sensitive Information via predictable export filenamesEPSS 0.6%CVE-2026-32731CRITICALApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip ExtractionEPSS 0.5%CVE-2026-42853MEDIUM@apostrophecms/cli: Command Injection in apos create via Unsanitized Password InputEPSS 0.5%CVE-2026-112955MEDIUMApostropheCMS: Import archives can exhaust server storage and deny serviceEPSS 0.5%CVE-2026-33888MEDIUMApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST APIEPSS 0.5%CVE-2026-113664MEDIUMApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testEPSS 0.5%CVE-2026-113650MEDIUMApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)EPSS 0.5%CVE-2026-63667MEDIUMApostropheCMS: Arbitrary file read via import-export attachment-name path traversalEPSS 0.5%CVE-2026-113656MEDIUMApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSEPSS 0.5%CVE-2026-113666HIGHApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceEPSS 0.4%CVE-2026-112954MEDIUMApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APIEPSS 0.4%CVE-2026-39857MEDIUMInformation Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field RestrictionsEPSS 0.4%CVE-2026-113654MEDIUMApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderEPSS 0.4%CVE-2026-71553HIGHApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoSEPSS 0.4%CVE-2026-113669MEDIUMApostropheCMS: Cross-domain session token in URL confers session takeoverEPSS 0.4%CVE-2026-113653MEDIUMApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)EPSS 0.4%CVE-2026-32730HIGHApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token MiddlewareEPSS 0.4%