Executive brief
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.
Affected products
- PyPI plone
Junglewise Threat Intelligence
CVE-2021-35959: PYSEC-2021-110 - In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT t
CVE-2021-35959 · Severity: low · CVSS 3.1 · Published 2021-06-30
Technologies: plone (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2889 - Plone Privilege Escallation
- PYSEC-2026-2964 - Plone unauthorized member addition vulnerability
- PYSEC-2026-2962 - Products.CMFPlone XSS in profile home_page property
- PYSEC-2026-2963 - Products.CMFPlone Open Redirect Vulnerability
- PYSEC-2026-2967 - Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone