Approved changes feed: RSS · Atom
cpe:2.3:a:ghost_foundation:ghost:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Ghost Foundation (19422b33-ebf6-5349-b995-df0ae795f0c9) |
|---|---|
| Product | Ghost (3bb08c87-89d1-5b89-b7af-ee10f4db02cc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-72596 |
vulnerable | 2026-09-16 04:33:09.346977 |
Ghost Foundation Ghost - Broken Access Control
HIGH (8.1)
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. An attacker with an Author account can delete any post on the platform.
Published: 2026-08-11T11:13:39.373Z
Updated: 2026-08-11T12:15:13.662Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-34559 |
vulnerable | 2026-06-08 06:37:33.479338 |
WordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerability
HIGH (7.5)
Insertion of Sensitive Information into Log File vulnerability in Ghost Foundation Ghost.This issue affects Ghost: from n/a through 1.4.0.
Published: 2024-05-09T12:03:01.037Z
Updated: 2026-04-28T16:09:49.526Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47197 |
vulnerable | 2026-06-08 05:50:39.993372 |
Details available
CRITICAL (9)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_foot` for a post.
Published: 2023-01-19T17:02:15.814Z
Updated: 2025-11-04T19:14:29.704Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47196 |
vulnerable | 2026-06-08 05:50:39.992902 |
Details available
CRITICAL (9)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_head` for a post.
Published: 2023-01-19T17:02:15.737Z
Updated: 2025-11-04T19:14:28.608Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47195 |
vulnerable | 2026-06-08 05:50:39.992234 |
Details available
CRITICAL (9)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `facebook` field for a user.
Published: 2023-01-19T17:02:15.655Z
Updated: 2025-11-04T19:14:27.525Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47194 |
vulnerable | 2026-06-08 05:50:39.989976 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-41697 |
vulnerable | 2026-06-08 05:48:30.809134 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-41654 |
vulnerable | 2026-06-08 05:48:30.711769 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.