PYSEC-2026-2962
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/products-cmfplone/PYSEC-2026-2962.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2962
- Aliases
- Published
- 2026-07-09T16:49:46.136141Z
- Modified
- 2026-07-13T16:43:02.361245195Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Products.CMFPlone XSS in profile home_page property
- Details
-
A member of the Plone site could set javascript in the
home_pageproperty of their profile, and have this executed when a visitor clicks the home page link on the author page. - References
-
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000482
- https://github.com/plone/Products.CMFPlone/issues/2232
- https://github.com/plone/Products.CMFPlone/pull/2233
- https://github.com/plone/Products.CMFPlone/pull/2234
- https://github.com/plone/Products.CMFPlone/pull/2235
- https://github.com/plone/Products.CMFPlone/pull/2236
- https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab
- https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b
- https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8
- https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373
- https://github.com/plone/Products.CMFPlone
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-71.yaml
- https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property
- https://pypi.org/project/products-cmfplone
- https://github.com/advisories/GHSA-859j-668v-mrr6
Affected packages
PyPI / products-cmfplone
Package
- Name
- products-cmfplone
- View open source insights on deps.dev
- Purl
- pkg:pypi/products-cmfplone
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed4.3.17Introduced5.0.0Fixed5.0.10Introduced5.1a1Fixed5.1.0
Affected versions
4.*
4.0b1
4.1a1
4.1a2
4.1a3
4.1b1
4.1b2
4.1rc2
4.1rc3
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.2a1
4.2a2
4.2b1
4.2b2
4.2rc1
4.2rc2
4.2
4.2.0.1
4.2.1
4.2.1.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.3a1
4.3a2
4.3b1
4.3b2
4.3rc1
4.3
4.3.1
4.3.2
4.3.3
4.3.4
4.3.4.1
4.3.5
4.3.6
4.3.7
4.3.8rc1
4.3.8
4.3.9
4.3.10rc1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.14
4.3.15
4.3.16
5.*
5.0
5.0.1
5.0.2
5.0.3rc1
5.0.3
5.0.3.1
5.0.4rc1
5.0.4
5.0.5rc1
5.0.5rc2
5.0.5
5.0.6rc1
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10rc1
5.1a1
5.1a2
5.1b2
5.1b3
5.1b4
5.1rc1
5.1rc2