Maven Package Vulnerabilities
Vulnerabilities associated with org.silverpeas.core:silverpeas-core-web.
Packages
Clear package- org.jenkins-ci.main:jenkins-core257 vulnerabilities
- org.apache.tomcat:tomcat160 vulnerabilities
- com.liferay.portal:release.portal.bom159 vulnerabilities
- com.liferay.portal:release.dxp.bom125 vulnerabilities
- org.keycloak:keycloak-services97 vulnerabilities
- com.fasterxml.jackson.core:jackson-databind80 vulnerabilities
- org.apache.tomcat.embed:tomcat-embed-core74 vulnerabilities
- org.apache.struts:struts2-core60 vulnerabilities
- org.keycloak:keycloak-core50 vulnerabilities
- org.xwiki.platform:xwiki-platform-oldcore46 vulnerabilities
- org.elasticsearch:elasticsearch44 vulnerabilities
- net.mingsoft:ms-mcms39 vulnerabilities
- org.apache.tomcat:tomcat-catalina39 vulnerabilities
- io.undertow:undertow-core38 vulnerabilities
- com.thoughtworks.xstream:xstream37 vulnerabilities
- com.jfinal:jfinal36 vulnerabilities
- org.jenkins-ci.plugins:script-security35 vulnerabilities
- org.apache.solr:solr-core31 vulnerabilities
- org.apache.tomcat:tomcat-coyote31 vulnerabilities
- org.opencms:opencms-core31 vulnerabilities
- org.springframework.security:spring-security-core31 vulnerabilities
- org.eclipse.jetty:jetty-server29 vulnerabilities
- org.bouncycastle:bcprov-jdk1426 vulnerabilities
- org.apache.openmeetings:openmeetings-parent25 vulnerabilities
- org.keycloak:keycloak-parent25 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-30139MEDIUM | Silverpeas Core has a reflected cross-site scripting vulnerabilityA reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attackers to execute arbitrary JavaScript in the context of a user's browser via crafted input. CWE-79Apr 22, 2026 | CVSS6.1v3.1 | EPSS0.188% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Silverpeas Core Cross-site Scripting vulnerabilityIn Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click o… CWE-79Jul 9, 2024 | CVSS-v4.0 | EPSS0.767% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-47325MEDIUM | Broken access control in SilverpeasSilverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces. CWE-284Dec 13, 2023 | CVSS5.4v3.1 | EPSS0.41% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47324MEDIUM | Cross-site Scripting in silverpeasSilverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. CWE-79Dec 13, 2023 | CVSS5.4v3.1 | EPSS0.477% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47323HIGH | Missing access control in SilverpeasThe notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators. Dec 13, 2023 | CVSS7.5v3.1 | EPSS0.766% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47321MEDIUM | Broken access control in SilverpeasSilverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. CWE-284Dec 13, 2023 | CVSS4.9v3.1 | EPSS0.629% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47327MEDIUM | Broken access control in SilverpeasThe "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL. CWE-284Dec 13, 2023 | CVSS4.3v3.1 | EPSS0.516% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47320HIGH | Broken access control in SilverpeasSilverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below. | CVSS8.1v3.1 | EPSS0.721% | PoCs8 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47322HIGH | Cross Site Request Forgery in SilverpeasThe "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application. | CVSS8.8v3.1 | EPSS0.395% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |