GCVE - cpe:2.3:a:magnolia-cms:magnolia_cms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:magnolia-cms:magnolia_cms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Magnolia Cms (`7b5eb8b8-1f7c-5c29-9d0b-ad149a0d4f7b`)
Product	Magnolia Cms (`cb175e28-d314-5b97-9c40-193b0607a889`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-46366`	vulnerable	2026-06-08 05:38:03.290998	Details available An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials. Published: 2022-02-11T20:08:50.000Z Updated: 2024-08-04T05:02:11.675Z Open on db.gcve.eu Reference links https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46366-CSRF%2BOpen%20Redirect-Magnolia%20CMS	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-46365`	vulnerable	2026-06-08 05:38:03.290491	Details available An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. Published: 2022-02-11T20:08:45.000Z Updated: 2024-08-04T05:02:11.534Z Open on db.gcve.eu Reference links https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46365-Unsafe%20XML%20Parsing-Magnolia%20CMS	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-46364`	vulnerable	2026-06-08 05:38:03.290102	Details available A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file. Published: 2022-02-11T20:08:44.000Z Updated: 2024-08-04T05:02:11.531Z Open on db.gcve.eu Reference links https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46364-YAML%20Deserialization-Magnolia%20CMS	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-46363`	vulnerable	2026-06-08 05:38:03.289598	Details available An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported files with Microsoft Excel. Published: 2022-02-11T20:08:42.000Z Updated: 2024-08-04T05:02:11.521Z Open on db.gcve.eu Reference links https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46363-Formula%20Injection-Magnolia%20CMS	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-46362`	vulnerable	2026-06-08 05:38:03.289088	Details available A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter. Published: 2022-02-11T20:08:42.000Z Updated: 2024-08-04T05:02:11.580Z Open on db.gcve.eu Reference links https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46362-Unauthenticated%20SSTI-Magnolia%20CMS	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-46361`	vulnerable	2026-06-08 05:38:03.288509	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25894`	vulnerable	2026-06-08 05:30:41.672558	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25893`	vulnerable	2026-06-08 05:30:41.671987	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.