Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-32276

Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an authenticated user may be able to execute arbitrary code in the Code Study Plugin. Versions 1.41.1 and 2.41.1 contain a patch.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Opensource-workshop
Products
Connect-cms
CVE-2026-32277

Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Versions 1.41.1 and 2.41.1 contain a patch.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Opensource-workshop
Products
Connect-cms
CVE-2026-32278

Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Versions 1.41.1 and 2.41.1 contain a patch.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Opensource-workshop
Products
Connect-cms
CVE-2026-32279

Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Opensource-workshop
Products
Connect-cms
CVE-2026-32299

Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Versions 1.41.1 and 2.41.1 contain a patch.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Opensource-workshop
Products
Connect-cms
CVE-2026-32300

Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Opensource-workshop
Products
Connect-cms