phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

Is silverstripe/framework vulnerable?

Composer silverstripe/framework has 148 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.

148advisories
3critical
0on CISA KEV
1no fix recorded
CVETitleSeverityCVSSAffectedFixed in
CVE-2010-1593SilverStripe vulnerable to Cross-site Scriptinglow0.0<2.3.52.3.5
CVE-2015-5062Silverstripe CMS Open Redirectmedium0.0<=3.1.13–
CVE-2012-4968Silverstripe XSS Vulnerabilitiesmedium0.0>=2.3 and <2.3.13 or >=2.4 and <2.4.72.3.13, 2.4.7
CVE-2020-6164Silverstripe CMS information disclosurehigh7.5>=4.0.0 and <4.4.7 or >=4.5.0 and <4.5.44.4.7, 4.5.4
CVE-2020-9280SilverStripe Folders migrated from 3.x may be unsafe to upload tohigh7.5>=4.0.0 and <4.4.64.4.6
CVE-2019-5715Silverstripe Framework SQLi Vulnerabilitycritical9.8>=3.0.0 and <3.6.7 or >=4.0.0 and <4.0.7 or >=3.7.0 and <3.7.3 or >=4.1.0 and <4.1.5 or >=4.2.0 and <4.2.4 or >=4.3.0 and <4.3.13.6.7, 4.0.7, 3.7.3, 4.1.5
CVE-2019-12204Missing warning can lead to unauthenticated admin access in SilverStripecritical9.8>=4.1.0 and <4.3.5 or >=4.4.0 and <4.4.44.3.5, 4.4.4
CVE-2019-12245Lack of access control on upoaded filesmedium5.3<3.6.8 or >=3.7.0 and <3.7.4 or >=4.0.0 and <4.3.6 or >=4.4.0 and <4.4.43.6.8, 3.7.4, 4.3.6, 4.4.4
CVE-2020-26138FormField with square brackets in field name skips validationmedium5.3>=3.0.0 and <4.7.4 or >=3.0.0 and <4.0.0 or >=4.0.0 and <4.7.44.7.4
CVE-2019-16409SilverStripe Versioned Files module Unpublished files are exposed publiclymedium5.3>=4.0.0 and <4.3.5 or >=4.4.0 and <4.4.44.3.5, 4.4.4
CVE-2024-47605Silverstripe Framework has a XSS via insert media remote file oembedmedium5.4<5.3.85.3.8
CVE-2019-14273Broken access control on filesmedium5.3>=4.0.0 and <4.3.5 or >=4.4.0 and <4.4.44.3.5, 4.4.4
CVE-2021-41559Quadratic blowup in Convert::xml2array()medium6.5>=4.0.0 and <4.10.94.10.9
CVE-2017-18049SilverStripe CSV Excel Macro Injectionmedium5.5<3.5.6 or >=3.6.0 and <3.6.3 or >=4.0.0 and <4.0.13.5.6, 3.6.3, 4.0.1
CVE-2019-12205Silverstripe Flash Clipboard Reflected XSSmedium6.1>=3.0.0 and <4.3.5 or >=4.4.0-rc1 and <4.4.4 or >=3.0.0 and <3.9.99 or >=4.3.0 and <4.3.5 or >=4.4.0 and <4.4.44.3.5, 4.4.4
CVE-2019-12617SilverStripe Priviledge escalation through cache pollutionlow2.7>=4.4.0 and <4.4.4 or >=4.3.0 and <4.3.54.4.4, 4.3.5
CVE-2020-25817SilverStripe XXE Vulnerability in CSSContentParsermedium4.8>=4.0.0 and <4.7.44.7.4
CVE-2022-38148Blind SQL Injection via GridFieldSortableHeaderhigh8.8>=4.0.0 and <4.10.11 or >=4.11.0 and <4.11.144.10.11, 4.11.14
CVE-2019-19326SilverStripe Web Cache Poisoning through HTTPRequestBuildermedium5.9>=4.0.0 and <4.4.7 or >=4.5.0 and <4.5.4 or >=3.0.0 and <3.7.54.4.7, 4.5.4, 3.7.5
CVE-2019-14272SilverStripe asset-admin Cross-site Scripting (XSS)medium5.4>=4.0.0 and <4.3.5 or >=4.4.0 and <4.4.44.3.5, 4.4.4
CVE-2022-38724Silverstripe XSS in shortcodesmedium5.4>=4.0.0 and <4.11.134.11.13
CVE-2022-25238Stored XSS via HTML fields in SilverStripe Frameworkmedium5.4>=4.0.0 and <4.10.94.10.9
CVE-2019-12246SilverStripe Denial of Service on flush and development URL toolsmedium4.3>=4.0.0 and <4.4.0 or <=3.6 or >=4.1.0 and <4.4.0 or >=4.2.0 and <4.4.0 or >=4.3.0 and <4.4.04.4.0
CVE-2019-19325Reflected XSS in SilverStripemedium6.1>=4.5.0 and <4.5.2 or >=4.0.0 and <4.4.54.5.2, 4.4.5
CVE-2020-9311Silverstripe CMS XSS Vulnerabilitymedium5.4>=3.0.0 and <3.7.53.7.5
CVE-2022-37430Stored XSS using uppercase characters in HTMLEditormedium5.4>=4.0.0 and <4.11.134.11.13
CVE-2022-28803Stored XSS in link tags added via XHR in SilverStripe Frameworkmedium5.4>=4.0.0 and <4.10.94.10.9
CVE-2022-38462Reflected XSS in querystring parametersmedium6.1>=4.0.0 and <4.11.134.11.13
CVE-2022-37429Stored XSS using HTMLEditormedium5.4>=4.0.0 and <4.11.134.11.13
CVE-2023-22728Missing permission check of canView in GridFieldPrintButtonmedium4.3<4.12.5 or >=4.0.0 and <4.12.54.12.5
CVE-2023-22729Open redirect vulnerability on CMSSecurity relogin screenmedium6.1<4.12.5 or >=4.0.0 and <4.12.54.12.5
CVE-2019-12203Session fixation in change password formmedium6.3>=3.7.0 and <3.7.4 or >=4.4.0 and <4.4.4 or >=3.6.0 and <3.6.8 or >=4.0.0 and <4.3.53.7.4, 4.4.4, 3.6.8, 4.3.5
CVE-2023-48714Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompletermedium4.3<4.13.39 or >=5.0.0 and <5.1.11 or >=3.0.0 and <4.0.0 or >=4.0.0 and <4.13.394.13.39, 5.1.11
CVE-2024-32981Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payloadmedium5.4<5.2.165.2.16
CVE-2024-53277Silverstripe Framework has a XSS in form messagesmedium5.4<5.3.85.3.8
CVE-2025-30148Silverstripe Framework has a XSS vulnerability in HTML editormedium5.4<5.3.235.3.23
CVE-2026-54720Silverstripe Framework: Possible XSS attack through media embedmedium5.4<6.2.26.2.2
GHSA-8v6m-7f5v-hhx6Silverstripe Brute force bypass on default admincritical9.1>=3.1.18 and <3.1.19 or >=3.2.3 and <3.2.4 or >=3.3.1 and <3.3.23.1.19, 3.2.4, 3.3.2
GHSA-265q-222x-52m6silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connectorhigh8.8>=4.0.0-rc1 and <4.0.6 or >=4.1.0-rc1 and <4.1.4 or >=4.2.0-rc1 and <4.2.34.0.6, 4.1.4, 4.2.3
GHSA-vcg6-8fxc-x5cqsilverstripe/framework allows upload of dangerous file typeshigh8.8>=3.6.5-rc1 and <3.6.6 or >=4.0.3-rc1 and <4.0.4 or >=4.1.0-rc1 and <4.1.13.6.6, 4.0.4, 4.1.1
GHSA-xx4r-5265-48j6silverstripe/framework SQL injection in full text searchhigh8.8>=3.5.0-rc1 and <3.5.6 or >=3.6.0-rc1 and <3.6.3 or >=4.0.0-rc1 and <4.0.13.5.6, 3.6.3, 4.0.1
GHSA-mqjc-x563-c9q8silverstripe/framework CSV Excel Macro Injectionhigh8.0>=3.5.0-rc1 and <3.5.6 or >=3.6.0-rc1 and <3.6.3 or >=4.0.0-rc1 and <4.0.13.5.6, 3.6.3, 4.0.1
GHSA-4qx8-j9vh-2628silverstripe/framework's User-Agent header not correctly invalidating user sessionhigh7.5>=3.5.0-rc1 and <3.5.6 or >=3.6.0-rc1 and <3.6.33.5.6, 3.6.3
GHSA-cwgq-83w5-8jfqsilverstripe/framework has possible denial of service attack vector when flushinghigh7.5>=4.0.0-rc1 and <4.0.5 or >=4.1.0-rc1 and <4.1.3 or >=4.2.0-rc1 and <4.2.24.0.5, 4.1.3, 4.2.2
GHSA-m5q3-mvcr-gc5msilverstripe/framework BackURL validation bypass with malformed URLshigh7.5>=4.0.0-rc1 and <4.0.4 or >=4.1.0-rc1 and <4.1.14.0.4, 4.1.1
GHSA-vgxh-x8jv-hmffsilverstripe/framework code execution vulnerabilityhigh7.5>=4.0.3-rc1 and <4.0.4 or >=4.1.0-rc1 and <4.1.14.0.4, 4.1.1
GHSA-25gq-jvx2-vg9xSilverstripe X-Forwarded-Host request hostname injectionhigh7.2>=3.1.0 and <3.1.133.1.13
GHSA-55qg-6c4m-mw6gsilverstripe/framework's URL parameters `isDev` and `isTest` unguardedmedium6.5>=4.0.0-rc1 and <4.0.4 or >=4.1.0rc1 and <4.1.14.0.4, 4.1.1
GHSA-87pf-7x99-5xc4Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headersmedium6.5<3.1.17 or >=3.2.0 and <3.2.2 or >=3.3.0-beta1 and <3.3.03.1.17, 3.2.2, 3.3.0
GHSA-g4hp-pfvf-vm5wSilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validationmedium6.5>=3.0.0 and <3.0.14 or >=3.1.0 and <3.1.133.0.14, 3.1.13
GHSA-m2hh-2m46-x6j5silverstripe/framework may disclose database credentials during connection failuremedium6.5>=3.7.0-rc1 and <3.7.1 or >=4.0.0-rc1 and <4.0.5 or >=4.1.0-rc1 and <4.1.3 or >=4.2.0-rc1 and <4.2.23.7.1, 4.0.5, 4.1.3, 4.2.2
GHSA-ph62-fv59-vf9hsilverstripe/framework users inadvertently passing sensitive data to LoginAttemptmedium6.5>=3.5.0-rc1 and <3.5.6 or >=3.6.0-rc1 and <3.6.3 or >=4.0.0-rc1 and <4.0.13.5.6, 3.6.3, 4.0.1
GHSA-r3pr-fh25-wrfcsilverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential formsmedium6.5>=4.0.0-rc1 and <4.0.14.0.1
GHSA-x5w2-wcr8-9q45Silverstripe Missing security check on dev/build/defaultsmedium6.5<3.1.17 or >=3.2.0 and <3.2.2 or >=3.3.0-beta1 and <3.3.03.1.17, 3.2.2, 3.3.0
GHSA-xpff-c35g-j3crsilverstripe/framework Privilege Escalation Risk in Member Edit formmedium6.5>=3.5.7-rc1 and <3.5.8 or >=3.6.0-rc1 and <3.6.6 or >=4.0.0-rc1 and <4.0.4 or >=4.1.0-rc1 and <4.1.13.5.8, 3.6.6, 4.0.4, 4.1.1
GHSA-34q6-xqxh-gq39Silverstripe XSS In rewritten hash linksmedium6.1<3.0.13 or >=3.1.0 and <3.1.123.0.13, 3.1.12
GHSA-468j-6jrc-2rjxsilverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField`medium6.1>=3.1.19-rc1 and <3.1.20 or >=3.2.4-rc1 and <3.2.5 or >=3.3.2-rc1 and <3.3.3 or >=3.4.0-rc1 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
GHSA-4h54-vwx9-3vr3Silverstripe XSS In FormActionmedium6.1>=3.1.0 and <3.1.103.1.10
GHSA-5f5v-5c3v-gw5vSilverstripe IE requests not properly behaving with rewritehashlinksmedium6.1<3.0.13 or >=3.1.0 and <3.1.123.0.13, 3.1.12
GHSA-88jp-9jrv-6368Silverstripe XSS In GridField printmedium6.1>=3.1.0 and <3.1.103.1.10
GHSA-97jm-g33h-f46gsilverstripe/framework ReadOnly transformation for formfields exploitablemedium6.1<3.1.21 or >=3.2.0 and <3.2.6 or >=3.3.0 and <3.3.4 or >=3.4.0 and <3.4.23.1.21, 3.2.6, 3.3.4, 3.4.2
GHSA-hhvj-mcrx-3vcfsilverstripe/framework has Cross-site Scripting vulnerability in page namemedium6.1>=3.4.0-rc1 and <3.4.4 or >=3.5.0-rc1 and <3.5.23.4.4, 3.5.2
GHSA-j982-5jv7-v43rSilverstripe Form field validation message XSS vulnerabilitymedium6.1>=3.0.0 and <3.1.16 or >=3.2.0 and <3.2.13.1.16, 3.2.1
GHSA-jqp8-v74p-g8pxSilverstripe XSS in Director::force_redirect()medium6.1>=3.1.0 and <3.1.123.1.12
GHSA-m8v7-x398-pxrfSilverstripe XSS in CMS Edit Pagemedium6.1>=3.1.18 and <3.1.19 or >=3.2.3 and <3.2.4 or >=3.3.1 and <3.3.23.1.19, 3.2.4, 3.3.2
GHSA-mpqj-f4v3-334hSilverstripe Cross-site scripting vulnerability in VersionedRequestFiltermedium6.1>=3.3.2 and <3.3.3 or >=3.4.0 and <3.4.13.3.3, 3.4.1
GHSA-mqf5-275h-gf6rSilverstripe framework is vulnerable to XSS in install.phpmedium6.1>=3.1.0 and <3.1.143.1.14
GHSA-pp7q-6j3f-74vjsilverstripe/framework has Cross-site Scripting vulnerability in RedirectorPagemedium6.1>=3.4.0-rc1 and <3.4.6 or >=3.5.0-rc1 and <3.5.43.4.6, 3.5.4
GHSA-r32j-mr8p-hfp8Silverstripe XSS in TreeDropdownField and TreeMultiSelectFieldmedium6.1>=3.1.0 and <3.1.103.1.10
GHSA-r85g-7jpv-8xrxsilverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURLmedium6.1>=3.1.0-rc1 and <3.1.21 or >=3.2.0-rc1 and <3.2.6 or >=3.3.0-rc1 and <3.3.4 or >=3.4.0-rc1 and <3.4.23.1.21, 3.2.6, 3.3.4, 3.4.2
GHSA-vp8p-c6xj-xpj7Silverstripe External redirection risk in Security?ReturnURLmedium5.8<3.0.14 or >=3.1.0 and <3.1.133.0.14, 3.1.13
GHSA-52cw-pvq9-9m5vSilverstripe uses TinyMCE which allows svg files linked in object tagsmedium5.4<5.2.165.2.16
GHSA-r9vp-fp72-xgf7silverstripe/framework's `Member.Name` is not escapedmedium5.4>=3.1.9-rc1 and <3.1.20 or >=3.2.4-rc1 and <3.2.5 or >=3.3.2-rc1 and <3.3.3 or >=3.4.0-rc1 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
GHSA-vj2j-6g3w-4662Silverstripe Missing CSRF protection in login formmedium5.4>=3.1.18 and <3.1.19 or >=3.2.3 and <3.2.4 or >=3.3.1 and <3.3.23.1.19, 3.2.4, 3.3.2
GHSA-256q-hx8w-xcqxSilverstripe Framework user enumeration via timing attack on login and password reset formsmedium5.3>=4.0.0 and <5.3.235.3.23
GHSA-crr3-h4m8-7f56silverstripe/framework vulnerable to member disclosure in login formmedium5.3>=4.0.0-rc1 and <4.0.4 or >=4.1.0-rc1 and <4.1.14.0.4, 4.1.1
GHSA-g43w-98wp-m694SilverStripe framework XML Quadratic Blowup Attackmedium5.3<3.1.123.1.12
GHSA-g84q-cq55-xwgpsilverstripe/framework member disclosure in login formmedium5.3>=3.4.0-rc1 and <3.4.6 or >=3.5.0-rc1 and <3.5.43.4.6, 3.5.4
GHSA-hq4p-5mpr-jj9mSilverstripe XSS in dev/build returnURL Parametermedium4.7<3.1.143.1.14
CVE-2022-0227Business Logic Errors in SilverStripe Frameworkmedium4.3<4.10.14.10.1
GHSA-2hpc-mf4q-j885Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompletermedium4.3<3.1.17 or >=3.2.0 and <3.2.2 or >=3.3.0-beta1 and <3.3.03.1.17, 3.2.2, 3.3.0
GHSA-52cx-hpc5-cxwcsilverstripe/framework missing ACL on reportsmedium4.3>=3.1.19-rc1 and <3.1.20 or >=3.2.4-rc1 and <3.2.5 or >=3.3.2-rc1 and <3.3.3 or >=3.4.0-rc1 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
GHSA-p5h2-vr99-xm99silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`medium4.3>=3.1.19-rc1 and <3.1.20 or >=3.2.4-rc1 and <3.2.5 or >=3.3.2-rc1 and <3.3.3 or >=3.4.0-rc1 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
GHSA-qp29-wcc2-vmpcSilverstripe HtmlEditor embed url sanitisationmedium4.3>=3.0.0 and <3.2.13.2.1
GHSA-vh7q-j8p5-2h4hsilverstripe/framework sends passwords back to browsers under some circumstanceslow3.5>=3.5.5-rc1 and <3.7.0 or >=4.0.3-rc1 and <4.0.4 or >=4.1.0-rc1 and <4.1.13.7.0, 4.0.4, 4.1.1
GHSA-5r8w-66hq-rc39silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabledlow3.1>=3.1.19-rc1 and <3.1.20 or >=3.2.4-rc1 and <3.2.5 or >=3.3.2-rc1 and <3.3.3 or >=3.4.0-rc1 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
CVE-2021-25817CVE-2021-25817 XXE: Vulnerability in CSSContentParserunknown0.0>=4.0.0 and <4.7.44.7.4
CVE-2023-32302Silverstripe Framework: Members with no password can be created and bypass custom login formslow0.0>=3.0.0 and <4.13.14 or >=5.0.0 and <5.0.134.13.14, 5.0.13
GHSA-74j9-xhqr-6qv3Reflected Cross Site Scripting (XSS) in error messagelow0.0<5.3.85.3.8
GHSA-7m2v-x7rg-5hm5silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset formshigh0.0>=3.5.0-rc1 and <3.5.5 or >=3.6.0-rc1 and <3.6.23.5.5, 3.6.2
GHSA-c4c3-j73v-634rsilverstripe/framework has Cross-site Scripting vulnerability in page history comparisonmedium0.0>=3.4.0-rc1 and <3.4.6 or >=3.5.0-rc1 and <3.5.43.4.6, 3.5.4
GHSA-f3wp-xpv2-6vmgsilverstripe/framework password encryption salt not updatedlow0.0>=3.1.19-rc1 and <3.1.20 or >=3.2.4-rc1 and <3.2.5 or >=3.3.2-rc1 and <3.3.3 or >=3.4.0-rc1 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
GHSA-f43j-8hq4-2xj9silverstripe/framework uploaded PHP script execution in assetsmedium0.0>=4.0.0-rc1 and <4.0.4 or >=4.1.0-rc1 and <4.1.14.0.4, 4.1.1
GHSA-mqf3-qpc3-g26qSilverstripe Framework has a Reflected Cross Site Scripting (XSS) in error messagelow0.0<5.3.85.3.8
SS-2014-015-1SS-2014-015: IE requests not properly behaving with rewritehashlinksunknown0.0>=3.0.0 and <3.0.13 or >=3.1.0 and <3.1.123.0.13, 3.1.12
SS-2014-017-1SS-2014-017: XML Quadratic Blowup Attackunknown0.0>=3.1.0 and <3.1.123.1.12
SS-2015-004-1SS-2015-004: TreeDropdownField and TreeMultiSelectField XSSunknown0.0>=3.1.0 and <3.1.103.1.10
SS-2015-006-1SS-2015-006: XSS In GridField printunknown0.0>=3.1.0 and <3.1.103.1.10
SS-2015-007-1SS-2015-007: XSS In FormActionunknown0.0>=3.1.0 and <3.1.103.1.10
SS-2015-009-1SS-2015-009: XSS In rewritten hash linksunknown0.0>=3.0.0 and <3.0.13 or >=3.1.0 and <3.1.123.0.13, 3.1.12
SS-2015-010-1SS-2015-010: XSS in Director::force_redirect()unknown0.0>=3.1.0 and <3.1.123.1.12
SS-2015-011-1SS-2015-011: Potential SQL Injection Vulnerabilityunknown0.0>=3.0.0 and <3.0.14 or >=3.1.0 and <3.1.133.0.14, 3.1.13
SS-2015-012-1SS-2015-012: External redirection risk in Security?ReturnURLunknown0.0>=3.0.0 and <3.0.14 or >=3.1.0 and <3.1.133.0.14, 3.1.13
SS-2015-013-1SS-2015-013: X-Forwarded-Host request hostname injectionunknown0.0>=3.1.0 and <3.1.133.1.13
SS-2015-014-1SS-2015-014: Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validationunknown0.0>=3.0.0 and <3.0.14 or >=3.1.0 and <3.1.133.0.14, 3.1.13
SS-2015-015-1SS-2015-015: XSS in dev/build returnURL Parameterunknown0.0>=3.1.0 and <3.1.143.1.14
SS-2015-016-1SS-2015-016: XSS in install.phpunknown0.0>=3.1.0 and <3.1.143.1.14
SS-2015-026-1SS-2015-026: Form field validation message XSS vulnerabilityunknown0.0>=3.0.0 and <3.1.0 or >=3.1.0 and <3.1.16 or >=3.2.0 and <3.2.13.1.16, 3.2.1
SS-2015-027-1SS-2015-027: HtmlEditor embed url sanitisationunknown0.0>=3.0.0 and <3.1.0 or >=3.1.0 and <3.2.0 or >=3.2.0 and <3.2.13.2.1
SS-2015-028-1SS-2015-028: Missing security check on dev/build/defaultsunknown0.0>=3.1.0 and <3.1.17 or >=3.2.0 and <3.2.2 or >3.2 and <3.3.03.1.17, 3.3.0
SS-2016-002-1SS-2016-002: CSRF vulnerability in GridFieldAddExistingAutocompleterunknown0.0>=3.1.0 and <3.1.17 or >=3.2.0 and <3.2.2 or >3.2 and <3.3.03.1.17, 3.3.0
SS-2016-003-1SS-2016-003: Hostname, IP and Protocol Spoofing through HTTP Headersunknown0.0>=3.1.0 and <3.1.17 or >=3.2.0 and <3.2.2 or >3.2 and <3.3.03.1.17, 3.3.0
SS-2016-004-1SS-2016-004: XSS in CMS Edit Pageunknown0.0>=3.1.18 and <3.1.19 or >=3.2.3 and <3.2.4 or >=3.3.1 and <3.3.23.1.19, 3.2.4, 3.3.2
SS-2016-005-1SS-2016-005: Brute force bypass on default adminunknown0.0>=3.1.18 and <3.1.19 or >=3.2.3 and <3.2.4 or >=3.3.1 and <3.3.23.1.19, 3.2.4, 3.3.2
SS-2016-006-1SS-2016-006: Missing CSRF protection in login formunknown0.0>=3.1.18 and <3.1.19 or >=3.2.3 and <3.2.4 or >=3.3.1 and <3.3.23.1.19, 3.2.4, 3.3.2
SS-2016-007-1SS-2016-007: VersionedRequestFilter vulnerabilityunknown0.0>=3.3.2 and <3.3.3 or >=3.4.0 and <3.4.13.3.3, 3.4.1
SS-2016-008-1SS-2016-008: Password encryption salt expiryunknown0.0>=3.1.19 and <3.1.20 or >=3.2.4 and <3.2.5 or >=3.3.2 and <3.3.3 or >=3.4.0 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
SS-2016-010-1SS-2016-010: ReadOnly transformation for formfields exploitableunknown0.0>=3.1.0 and <3.1.21 or >=3.2.0 and <3.2.6 or >=3.3.0 and <3.3.4 or >=3.4.0 and <3.4.23.1.21, 3.2.6, 3.3.4, 3.4.2
SS-2016-011-1SS-2016-011: ChangePasswordForm does not check Member::canLogIn()unknown0.0>=3.1.19 and <3.1.20 or >=3.2.4 and <3.2.5 or >=3.3.2 and <3.3.3 or >=3.4.0 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
SS-2016-012-1SS-2016-012: Missing ACL on reportsunknown0.0>=3.1.19 and <3.1.20 or >=3.2.4 and <3.2.5 or >=3.3.2 and <3.3.3 or >=3.4.0 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
SS-2016-013-1SS-2016-013: Member.Name is not escapedunknown0.0>=3.1.9 and <3.1.20 or >=3.2.4 and <3.2.5 or >=3.3.2 and <3.3.3 or >=3.4.0 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
SS-2016-014-1SS-2016-014: Pre-existing alc_enc cookies log users in if remember me is disabledunknown0.0>=3.1.19 and <3.1.20 or >=3.2.4 and <3.2.5 or >=3.3.2 and <3.3.3 or >=3.4.0 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
SS-2016-015-1SS-2016-015: XSS In OptionsetField and CheckboxSetFieldunknown0.0>=3.1.19 and <3.1.20 or >=3.2.4 and <3.2.5 or >=3.3.2 and <3.3.3 or >=3.4.0 and <3.4.13.1.20, 3.2.5, 3.3.3, 3.4.1
SS-2016-016-1SS-2016-016: XSS In CMSSecurity BackURLunknown0.0>=3.1.0 and <3.1.21 or >=3.2.0 and <3.2.6 or >=3.3.0 and <3.3.4 or >=3.4.0 and <3.4.23.1.21, 3.2.6, 3.3.4, 3.4.2
SS-2017-001-1SS-2017-001: XSS In page nameunknown0.0>=3.4.0 and <3.4.4 or >=3.5.0 and <3.5.23.4.4, 3.5.2
SS-2017-002-1SS-2017-002: Member disclosure in login formunknown0.0>=3.4.0 and <3.4.6 or >=3.5.0 and <3.5.43.4.6, 3.5.4
SS-2017-003-1SS-2017-003: XSS in RedirectorPageunknown0.0>=3.4.0 and <3.4.6 or >=3.5.0 and <3.5.43.4.6, 3.5.4
SS-2017-004-1SS-2017-004: XSS in page history comparisonunknown0.0>=3.4.0 and <3.4.6 or >=3.5.0 and <3.5.43.4.6, 3.5.4
SS-2017-005-1SS-2017-005: User enumeration via timing attack on login and password reset formsunknown0.0>=3.5.0 and <3.5.5 or >=3.6.0 and <3.6.23.5.5, 3.6.2
SS-2017-006-1SS-2017-006: Session user agent change detectionunknown0.0>=3.5.0 and <3.5.6 or >=3.6.0 and <3.6.33.5.6, 3.6.3
SS-2017-007-1SS-2017-007: CSV Excel Macro Injectionunknown0.0>=3.5.0 and <3.5.6 or >=3.6.0 and <3.6.3 or >=4.0.0 and <4.0.13.5.6, 3.6.3, 4.0.1
SS-2017-008-1SS-2017-008: SQL injection in full text search of SilverStripe 4unknown0.0>=3.5.0 and <3.5.6 or >=3.6.0 and <3.6.3 or >=4.0.0 and <4.0.13.5.6, 3.6.3, 4.0.1
SS-2017-009-1SS-2017-009: Users inadvertently passing sensitive data to LoginAttemptunknown0.0>=3.5.0 and <3.5.6 or >=3.6.0 and <3.6.3 or >=4.0.0 and <4.0.13.5.6, 3.6.3, 4.0.1
SS-2017-010-1SS-2017-010: install.php discloses sensitive data by pre-populating DB credential formsunknown0.0>=4.0.0 and <4.0.14.0.1
SS-2018-001-1SS-2018-001: Privilege Escalation Risk in Member Edit formunknown0.0>=3.5.7 and <3.5.8 or >=3.6.0 and <3.6.6 or >=4.0.0 and <4.0.4 or >=4.1.0 and <4.1.13.5.8, 3.6.6, 4.0.4, 4.1.1
SS-2018-005-1SS-2018-005: isDev and isTest unguardedunknown0.0>=4.0.0 and <4.0.4 or >=4.1.0 and <4.1.14.0.4, 4.1.1
SS-2018-006-1SS-2018-006: Code execution vulnerabilityunknown0.0>=4.0.3 and <4.0.4 or >=4.1.0 and <4.1.14.0.4, 4.1.1
SS-2018-008-1SS-2018-008: BackURL validation bypass with malformed URLsunknown0.0>=4.0.0 and <4.0.4 or >=4.1.0 and <4.1.14.0.4, 4.1.1
SS-2018-010-1SS-2018-010: Member disclosure in login formunknown0.0>=4.0.0 and <4.0.4 or >=4.1.0 and <4.1.14.0.4, 4.1.1
SS-2018-012-1SS-2018-012: Uploaded PHP script execution in assetsunknown0.0>=4.0.0 and <4.0.4 or >=4.1.0 and <4.1.14.0.4, 4.1.1
SS-2018-013-1SS-2018-013: Passwords sent back to browsers under some circumstancesunknown0.0>=3.5.5 and <3.7.0 or >=4.0.3 and <4.0.4 or >=4.1.0 and <4.1.13.7.0, 4.0.4, 4.1.1
SS-2018-014-1SS-2018-014: Dangerous file types in allowed uploadunknown0.0>=3.6.5 and <3.6.6 or >=4.0.3 and <4.0.4 or >=4.1.0 and <4.1.13.6.6, 4.0.4, 4.1.1
SS-2018-018-1SS-2018-018: Database credentials disclosure during connection failureunknown0.0>=3.7.0 and <3.7.1 or >=4.0.0 and <4.0.5 or >=4.1.0 and <4.1.3 or >=4.2.0 and <4.2.23.7.1, 4.0.5, 4.1.3, 4.2.2
SS-2018-019-1SS-2018-019: Possible denial of service attack vector when flushingunknown0.0>=4.0.0 and <4.0.5 or >=4.1.0 and <4.1.3 or >=4.2.0 and <4.2.24.0.5, 4.1.3, 4.2.2
SS-2018-020-1SS-2018-020: Potential SQL vulnerability in PostgreSQL database connectorunknown0.0>=4.0.0 and <4.0.6 or >=4.1.0 and <4.1.4 or >=4.2.0 and <4.2.34.0.6, 4.1.4, 4.2.3
SS-2024-001SS-2024-001 - TinyMCE allows svg files linked in object tagsunknown0.0<5.2.165.2.16
SS-2024-002SS-2024-002 - Reflected Cross Site Scripting (XSS) in error messageunknown0.0<5.3.85.3.8
SS-2025-001SS-2025-001 - User enumeration via timing attackunknown0.0<5.3.235.3.23

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs   How findings are ranked
A version is vulnerable when it falls inside an affected range and below the fixed version. phpwarden applies these ranges to the exact versions in your lockfile or install, so you only see what applies to you.