# silverstripe/framework (Packagist) vulnerabilities

Source: https://junglewise.ai/threats/technologies/silverstripe-framework  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/silverstripe-framework.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 93 vulnerabilities in silverstripe/framework (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-54720, was published on 1 July 2026.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 93 (0 critical, 0 exploited in the wild)

## About silverstripe/framework (Packagist)

Open-source PHP web application framework for building websites and applications.

## Latest silverstripe/framework (Packagist) vulnerabilities

- [CVE-2026-54720: Silverstripe Framework XSS in Insert media from web functionality](https://junglewise.ai/threats/cve-2026-54720-silverstripe-framework-xss-in-insert-media-from-web-functionality) (medium, CVSS 5.4, published 1 Jul 2026)
- [Silverstripe Framework user enumeration via timing attack on login and password reset forms](https://junglewise.ai/threats/silverstripe-framework-user-enumeration-via-timing-attack-on-login-and-ffb66d1a) (low, CVSS 3.1, published 10 Apr 2025)
- [CVE-2025-30148: Silverstripe Framework has a XSS vulnerability in HTML editor](https://junglewise.ai/threats/cve-2025-30148-silverstripe-framework-has-a-xss-vulnerability-in-html-editor) (low, CVSS 3.1, published 10 Apr 2025)
- [Reflected Cross Site Scripting (XSS) in error message](https://junglewise.ai/threats/reflected-cross-site-scripting-xss-in-error-message-34236f6e) (info, published 23 Jan 2025)
- [Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message](https://junglewise.ai/threats/silverstripe-framework-has-a-reflected-cross-site-scripting-xss-in-250a177b) (low, CVSS 3.1, published 14 Jan 2025)
- [CVE-2024-53277: Silverstripe Framework has a XSS in form messages](https://junglewise.ai/threats/cve-2024-53277-silverstripe-framework-has-a-xss-in-form-messages) (low, CVSS 3.1, published 14 Jan 2025)
- [CVE-2024-47605: Silverstripe Framework has a XSS via insert media remote file oembed](https://junglewise.ai/threats/cve-2024-47605-silverstripe-framework-has-a-xss-via-insert-media-remote-file) (low, CVSS 3.1, published 14 Jan 2025)
- [Silverstripe uses TinyMCE which allows svg files linked in object tags](https://junglewise.ai/threats/silverstripe-uses-tinymce-which-allows-svg-files-linked-in-object-tags-cf1a5101) (low, CVSS 3.1, published 17 Jul 2024)
- [CVE-2024-32981: Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload](https://junglewise.ai/threats/cve-2024-32981-silverstripe-framework-has-a-cross-site-scripting-vulnerability) (low, CVSS 3.1, published 17 Jul 2024)
- [silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector](https://junglewise.ai/threats/silverstripe-framework-has-potential-sql-injection-vulnerability-in-cf9ac7f8) (low, CVSS 3.1, published 28 May 2024)
- [silverstripe/framework has possible denial of service attack vector when flushing](https://junglewise.ai/threats/silverstripe-framework-has-possible-denial-of-service-attack-vector-7d0dce62) (low, CVSS 3.1, published 28 May 2024)
- [silverstripe/framework may disclose database credentials during connection failure](https://junglewise.ai/threats/silverstripe-framework-may-disclose-database-credentials-during-07a8a27e) (low, CVSS 3.1, published 28 May 2024)
- [silverstripe/framework allows upload of dangerous file types](https://junglewise.ai/threats/silverstripe-framework-allows-upload-of-dangerous-file-types-ac6d8d2d) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework vulnerable to member disclosure in login form](https://junglewise.ai/threats/silverstripe-framework-vulnerable-to-member-disclosure-in-login-form-a1d746d2) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework sends passwords back to browsers under some circumstances](https://junglewise.ai/threats/silverstripe-framework-sends-passwords-back-to-browsers-under-some-6e94fa51) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework uploaded PHP script execution in assets](https://junglewise.ai/threats/silverstripe-framework-uploaded-php-script-execution-in-assets-c6c2e7cd) (info, published 27 May 2024)
- [silverstripe/framework code execution vulnerability](https://junglewise.ai/threats/silverstripe-framework-code-execution-vulnerability-7031db02) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework BackURL validation bypass with malformed URLs](https://junglewise.ai/threats/silverstripe-framework-backurl-validation-bypass-with-malformed-urls-20c36e7a) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms](https://junglewise.ai/threats/silverstripe-framework-s-install-php-script-discloses-sensitive-data-by-ee02f186) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework Privilege Escalation Risk in Member Edit form](https://junglewise.ai/threats/silverstripe-framework-privilege-escalation-risk-in-member-edit-form-97ea5bc6) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework's URL parameters `isDev` and `isTest` unguarded](https://junglewise.ai/threats/silverstripe-framework-s-url-parameters-isdev-and-istest-unguarded-4187ab3c) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework SQL injection in full text search](https://junglewise.ai/threats/silverstripe-framework-sql-injection-in-full-text-search-3a03f1e3) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework users inadvertently passing sensitive data to LoginAttempt](https://junglewise.ai/threats/silverstripe-framework-users-inadvertently-passing-sensitive-data-to-92b28f7e) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework CSV Excel Macro Injection](https://junglewise.ai/threats/silverstripe-framework-csv-excel-macro-injection-e5d2dfee) (low, CVSS 3.1, published 27 May 2024)
- [silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms](https://junglewise.ai/threats/silverstripe-framework-vulnerable-to-user-enumeration-via-timing-attack-939ffd3a) (info, published 27 May 2024)

## Most severe silverstripe/framework (Packagist) vulnerabilities

- [CVE-2026-54720: Silverstripe Framework XSS in Insert media from web functionality](https://junglewise.ai/threats/cve-2026-54720-silverstripe-framework-xss-in-insert-media-from-web-functionality) (medium, CVSS 5.4, published 1 Jul 2026)
- [CVE-2010-1593: SilverStripe vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2010-1593-silverstripe-vulnerable-to-cross-site-scripting) (medium, CVSS 4, published 14 May 2022)
- [CVE-2020-6164: Silverstripe CMS information disclosure](https://junglewise.ai/threats/cve-2020-6164-silverstripe-cms-information-disclosure) (low, CVSS 3.1, published 24 May 2022)
- [CVE-2020-9280: SilverStripe Folders migrated from 3.x may be unsafe to upload to](https://junglewise.ai/threats/cve-2020-9280-silverstripe-folders-migrated-from-3-x-may-be-unsafe-to-upload-to) (low, CVSS 3.1, published 24 May 2022)
- [CVE-2019-12204: Missing warning can lead to unauthenticated admin access in SilverStripe](https://junglewise.ai/threats/cve-2019-12204-missing-warning-can-lead-to-unauthenticated-admin-access-in) (low, CVSS 3.1, published 12 Nov 2019)
- [CVE-2019-12245: Lack of access control on upoaded files](https://junglewise.ai/threats/cve-2019-12245-lack-of-access-control-on-upoaded-files) (low, CVSS 3.1, published 12 Nov 2019)
- [CVE-2020-26138: FormField with square brackets in field name skips validation](https://junglewise.ai/threats/cve-2020-26138-formfield-with-square-brackets-in-field-name-skips-validation) (low, CVSS 3.1, published 26 Mar 2022)
- [CVE-2019-16409: SilverStripe Versioned Files module Unpublished files are exposed publicly](https://junglewise.ai/threats/cve-2019-16409-silverstripe-versioned-files-module-unpublished-files-are-exposed) (low, CVSS 3.1, published 12 Nov 2019)
- [CVE-2024-47605: Silverstripe Framework has a XSS via insert media remote file oembed](https://junglewise.ai/threats/cve-2024-47605-silverstripe-framework-has-a-xss-via-insert-media-remote-file) (low, CVSS 3.1, published 14 Jan 2025)
- [CVE-2019-14273: Broken access control on files](https://junglewise.ai/threats/cve-2019-14273-broken-access-control-on-files) (low, CVSS 3.1, published 15 Jul 2020)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Packagist technologies

- [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities
- [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities
- [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities
- [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities
- [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities
- [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities
- [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities
- [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities
- [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities
- [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities
- [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities
- [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "silverstripe/framework (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/silverstripe-framework, 9 November 2026.