GCVE - cpe:2.3:a:silverstripe:silverstripe:2.4.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:silverstripe:silverstripe:2.4.5:*:*:*:*:*:*:*

part: a version: 2.4.5 update: *

Vendor	Silverstripe (`fb3ee4e6-70c4-5017-82a7-81441bb33bd1`)
Product	Silverstripe (`a3b26fc2-6e91-5c07-b521-62f2382ac950`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/silverstripe/silverstripe-cms`	purl2cpe	2026-06-01 10:14:20.994073

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-4968`	vulnerable	2026-06-08 05:02:53.458957	Details available Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted string to the AbsoluteLinks, (2) BigSummary, (3) ContextSummary, (4) EscapeXML, (5) FirstParagraph, (6) FirstSentence, (7) Initial, (8) LimitCharacters, (9) LimitSentences, (10) LimitWordCount, (11) LimitWordCountXML, (12) Lower, (13) LowerCase, (14) NoHTML, (15) Summary, (16) Upper, (17) UpperCase, or (18) URL method in a template, different vectors than CVE-2012-0976. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-16T19:11:05.166Z Open on db.gcve.eu Reference links http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13 https://github.com/silverstripe/sapphire/commit/0085876	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4962`	vulnerable	2026-06-08 04:59:34.065606	Details available code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-17T03:23:38.376Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/04/30/1 https://github.com/silverstripe/silverstripe-cms/commit/d15e850 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4961`	vulnerable	2026-06-08 04:59:34.065148	Details available SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-16T17:19:06.700Z Open on db.gcve.eu Reference links https://github.com/silverstripe/sapphire/commit/de1f070 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4960`	vulnerable	2026-06-08 04:59:34.064420	Details available SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-17T00:52:26.777Z Open on db.gcve.eu Reference links https://github.com/silverstripe/sapphire/commit/fef7c32 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4959`	vulnerable	2026-06-08 04:59:34.063702	Details available SQL injection vulnerability in the addslashes method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6, when connected to a MySQL database using far east character encodings, allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-17T02:10:53.830Z Open on db.gcve.eu Reference links https://github.com/silverstripe/sapphire/commit/73cca09 https://github.com/silverstripe/silverstripe-cms/commit/b5ea2f6 https://github.com/silverstripe/sapphire/commit/ca78784 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4958`	vulnerable	2026-06-08 04:59:34.062756	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.