publify_core Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with publify_core products.
Products
- publify_core3 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-25975MEDIUM | Publify - Stored Cross-Site Scripting (XSS) due to Unrestricted File UploadIn publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file. CWE-79Nov 10, 2021 | CVSS5.4v3.1 | EPSS0.578% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-25974MEDIUM | Publify - Stored Cross-Site Scripting (XSS) in EditorIn Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article. CWE-79Nov 10, 2021 | CVSS5.4v3.1 | EPSS0.578% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-25973MEDIUM | Publify - Improper Authorization Leads to Guest Signup Restriction BypassIn Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only. | CVSS6.5v3.1 | EPSS0.8% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |