Vulnerabilidades em apostrophecms
56 resultadosAnálise Vexday
ApostropheCMS apresenta 18 vulnerabilidades catalogadas, com 10 delas publicadas nos últimos 90 dias, indicando atividade recente significativa. Embora nenhuma vulnerabilidade esteja sob exploração ativa confirmada (KEV), 3 são críticas e a fraqueza dominante é XSS (CWE-79), típica de plataformas de conteúdo, representando risco de comprometimento de sessões e dados de usuários. A cadência elevada de descobertas recentes recomenda monitoramento contínuo e aplicação de patches prioritários nas versões em produção.
CVE-2026-113667MEDIUMApostropheCMS: CAPTCHA response token not URL-encodedEPSS 0.4%CVE-2026-33877LOWApostropheCMS: User Enumeration via Timing Side Channel in Password Reset EndpointEPSS 0.4%CVE-2026-113660MEDIUMApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft IdentifiersEPSS 0.4%CVE-2026-113665LOWApostropheCMS: Missing Authorization on Notification PATCH/DELETE EndpointsEPSS 0.3%CVE-2026-53609CRITICALApostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassEPSS 0.3%CVE-2026-113659MEDIUMApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersEPSS 0.3%CVE-2026-112956MEDIUMApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentEPSS 0.3%CVE-2026-112952MEDIUMApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated userEPSS 0.3%CVE-2026-113710MEDIUMApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password GuessingEPSS 0.3%CVE-2026-113671MEDIUMApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFEPSS 0.3%CVE-2026-113648LOWApostropheCMS: Missing Authentication in `cleanExport` RouteEPSS 0.3%CVE-2026-113651LOWApostropheCMS: Path traversal in uploadfsEPSS 0.3%CVE-2026-63670MEDIUMApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus closeEPSS 0.3%CVE-2026-113655MEDIUMApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationEPSS 0.3%CVE-2026-113668MEDIUMApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)EPSS 0.3%CVE-2026-113657LOWApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)EPSS 0.3%CVE-2026-63669MEDIUMApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtreeEPSS 0.3%CVE-2026-112957MEDIUMApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersEPSS 0.3%CVE-2026-45013HIGHApostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input ValidationEPSS 0.3%CVE-2026-112951MEDIUMApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixEPSS 0.3%