GCVE - cpe:2.3:a:sixapart:movable_type:4.291:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sixapart:movable_type:4.291:*:*:*:*:*:*:*

part: a version: 4.291 update: *

Vendor	Sixapart (`543b49bd-f8e0-5cde-b451-64c37d476b91`)
Product	Movable Type (`0b1b8903-7eaa-5490-a1bc-f063c17195fc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-0209`	vulnerable	2026-06-08 05:03:45.849628	Details available lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code. Published: 2013-01-23T01:00:00.000Z Updated: 2024-09-16T23:35:35.688Z Open on db.gcve.eu Reference links http://www.sec-1.com/blog/?p=402 http://www.movabletype.org/2013/01/movable_type_438_patch.html http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt http://openwall.com/lists/oss-security/2013/01/22/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0320`	vulnerable	2026-06-08 05:00:40.799861	Details available Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote attackers to take control of sessions via unspecified vectors related to the (1) commenting feature and (2) community script. Published: 2012-03-03T02:00:00.000Z Updated: 2024-08-06T18:23:30.494Z Open on db.gcve.eu Reference links http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://jvn.jp/en/jp/JVN20083397/index.html http://www.securityfocus.com/bid/52138 http://www.debian.org/security/2012/dsa-2423 http://www.securitytracker.com/id?1026738	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0317`	vulnerable	2026-06-08 05:00:40.688836	Details available Multiple cross-site request forgery (CSRF) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to hijack the authentication of arbitrary users for requests that modify data via the (1) commenting feature or (2) community script. Published: 2012-03-03T02:00:00.000Z Updated: 2024-08-06T18:23:30.608Z Open on db.gcve.eu Reference links http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.securityfocus.com/bid/52138 http://www.debian.org/security/2012/dsa-2423 http://jvndb.jvn.jp/jvndb/JVNDB-2012-000015 http://www.securitytracker.com/id?1026738	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-5085`	vulnerable	2026-06-08 04:59:34.538307	Details available Unspecified vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to read or modify data via unknown vectors. Published: 2012-04-02T18:00:00.000Z Updated: 2024-08-07T00:23:40.017Z Open on db.gcve.eu Reference links http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-5084`	vulnerable	2026-06-08 04:59:34.528871	Details available Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2012-04-02T18:00:00.000Z Updated: 2024-08-07T00:23:40.109Z Open on db.gcve.eu Reference links http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.