# sulu/sulu (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/sulu-sulu Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/sulu-sulu.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in sulu/sulu (Packagist): 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-92692, was published on 23 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 4 - All time: 17 (0 critical, 0 exploited in the wild) ## About sulu/sulu (Packagist) An open-source content management system based on the Symfony PHP framework. ## Latest sulu/sulu (Packagist) vulnerabilities - [CVE-2026-92692: Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the…](https://junglewise.ai/threats/cve-2026-92692-sulu-jcr-sql2-injection-in-category-filter) (medium, CVSS 4, published 23 Sep 2026) - [CVE-2026-82396: Sulu stored XSS via media download inline-disposition override](https://junglewise.ai/threats/cve-2026-82396-sulu-stored-xss-via-media-download-inline-disposition-override) (medium, CVSS 5.4, published 31 Aug 2026) - [CVE-2026-82395: Sulu media move authorization bypass (IDOR)](https://junglewise.ai/threats/cve-2026-82395-sulu-media-move-authorization-bypass-idor) (medium, CVSS 4, published 31 Aug 2026) - [CVE-2026-82394: Sulu authorization bypass in preview link generation](https://junglewise.ai/threats/cve-2026-82394-sulu-authorization-bypass-in-preview-link-generation) (medium, CVSS 4, published 31 Aug 2026) - [CVE-2026-45701: Sulu CMS weak cryptographic hash in password reset and API keys](https://junglewise.ai/threats/cve-2026-45701-sulu-cms-weak-cryptographic-hash-in-password-reset-and-api-keys) (medium, CVSS 4, published 1 Jun 2026) - [CVE-2026-34372: Sulu CMS authentication bypass in contact sub-entities API](https://junglewise.ai/threats/cve-2026-34372-sulu-cms-authentication-bypass-in-contact-sub-entities-api) (medium, CVSS 4, published 31 Mar 2026) - [CVE-2025-47778: Sulu vulnerable to XXE in SVG File upload Inspector](https://junglewise.ai/threats/cve-2025-47778-sulu-vulnerable-to-xxe-in-svg-file-upload-inspector) (medium, CVSS 4, published 15 May 2025) - [CVE-2024-47617: Injection of arbitrary HTML/JavaScript code through the media download URL](https://junglewise.ai/threats/cve-2024-47617-injection-of-arbitrary-html-javascript-code-through-the-media) (low, CVSS 3.1, published 3 Oct 2024) - [CVE-2024-47618: Cross-site Scripting via uploaded SVG](https://junglewise.ai/threats/cve-2024-47618-cross-site-scripting-via-uploaded-svg) (low, CVSS 3.1, published 3 Oct 2024) - [CVE-2024-27915: Sulu grants access to pages regardless of role permissions](https://junglewise.ai/threats/cve-2024-27915-sulu-grants-access-to-pages-regardless-of-role-permissions) (low, CVSS 3.1, published 4 Mar 2024) - [CVE-2024-24807: Sulu HTML Injection via Autocomplete Suggestion](https://junglewise.ai/threats/cve-2024-24807-sulu-html-injection-via-autocomplete-suggestion) (info, published 5 Feb 2024) - [CVE-2023-39343: Sulu Observable Response Discrepancy on Admin Login](https://junglewise.ai/threats/cve-2023-39343-sulu-observable-response-discrepancy-on-admin-login) (low, CVSS 3.1, published 3 Aug 2023) - [CVE-2021-43835: Privilege escalation in the Sulu Admin panel](https://junglewise.ai/threats/cve-2021-43835-privilege-escalation-in-the-sulu-admin-panel) (low, CVSS 3.1, published 15 Dec 2021) - [CVE-2021-43836: PHP file inclusion in the Sulu admin panel](https://junglewise.ai/threats/cve-2021-43836-php-file-inclusion-in-the-sulu-admin-panel) (low, CVSS 3.1, published 15 Dec 2021) - [CVE-2021-41169: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu](https://junglewise.ai/threats/cve-2021-41169-improper-neutralization-of-script-related-html-tags-in-a-web-page) (low, CVSS 3.1, published 22 Oct 2021) - [CVE-2021-32737: XSS Injection in Media Collection Title was possible](https://junglewise.ai/threats/cve-2021-32737-xss-injection-in-media-collection-title-was-possible) (low, CVSS 3.1, published 2 Jul 2021) - [CVE-2020-15132: Reset Password / Login vulnerability in Sulu](https://junglewise.ai/threats/cve-2020-15132-reset-password-login-vulnerability-in-sulu) (low, CVSS 3.1, published 5 Aug 2020) ## Most severe sulu/sulu (Packagist) vulnerabilities - [CVE-2026-82396: Sulu stored XSS via media download inline-disposition override](https://junglewise.ai/threats/cve-2026-82396-sulu-stored-xss-via-media-download-inline-disposition-override) (medium, CVSS 5.4, published 31 Aug 2026) - [CVE-2026-82394: Sulu authorization bypass in preview link generation](https://junglewise.ai/threats/cve-2026-82394-sulu-authorization-bypass-in-preview-link-generation) (medium, CVSS 4, published 31 Aug 2026) - [CVE-2025-47778: Sulu vulnerable to XXE in SVG File upload Inspector](https://junglewise.ai/threats/cve-2025-47778-sulu-vulnerable-to-xxe-in-svg-file-upload-inspector) (medium, CVSS 4, published 15 May 2025) - [CVE-2026-82395: Sulu media move authorization bypass (IDOR)](https://junglewise.ai/threats/cve-2026-82395-sulu-media-move-authorization-bypass-idor) (medium, CVSS 4, published 31 Aug 2026) - [CVE-2026-34372: Sulu CMS authentication bypass in contact sub-entities API](https://junglewise.ai/threats/cve-2026-34372-sulu-cms-authentication-bypass-in-contact-sub-entities-api) (medium, CVSS 4, published 31 Mar 2026) - [CVE-2026-92692: Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the…](https://junglewise.ai/threats/cve-2026-92692-sulu-jcr-sql2-injection-in-category-filter) (medium, CVSS 4, published 23 Sep 2026) - [CVE-2026-45701: Sulu CMS weak cryptographic hash in password reset and API keys](https://junglewise.ai/threats/cve-2026-45701-sulu-cms-weak-cryptographic-hash-in-password-reset-and-api-keys) (medium, CVSS 4, published 1 Jun 2026) - [CVE-2021-43836: PHP file inclusion in the Sulu admin panel](https://junglewise.ai/threats/cve-2021-43836-php-file-inclusion-in-the-sulu-admin-panel) (low, CVSS 3.1, published 15 Dec 2021) - [CVE-2021-43835: Privilege escalation in the Sulu Admin panel](https://junglewise.ai/threats/cve-2021-43835-privilege-escalation-in-the-sulu-admin-panel) (low, CVSS 3.1, published 15 Dec 2021) - [CVE-2020-15132: Reset Password / Login vulnerability in Sulu](https://junglewise.ai/threats/cve-2020-15132-reset-password-login-vulnerability-in-sulu) (low, CVSS 3.1, published 5 Aug 2020) ## Vulnerabilities per week Nothing in the last four weeks, down from 1 vulnerability in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 3 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "sulu/sulu (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/sulu-sulu, 9 November 2026.