[MEDIUM] CVE-2024-32981 - XSS Vulnerability with text/html base64-encoded payload

PKSA-jndv-7cgy-xwm3 CVE-2024-32981 GHSA-chx7-9x8h-r5mg

Affected version: <5.2.16

Reported by:
GitHub, FriendsOfPHP/security-advisories

SS-2024-001 - TinyMCE allows svg files linked in object tags

PKSA-8tf6-2hv5-c6tq

Affected version: <5.2.16

Reported by:
FriendsOfPHP/security-advisories

[MEDIUM] CVE-2023-48714 Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter

PKSA-vcdc-4796-kn58 CVE-2023-48714 GHSA-qm2j-qvq3-j29v

Affected version: >=3.0.0,<4.0.0|>=4.0.0,<4.13.39|>=5.0.0,<5.1.11

Reported by:
GitHub, FriendsOfPHP/security-advisories

[LOW] CVE-2023-32302 - Members with no password can be created and bypass custom login forms

PKSA-2t2m-vnwy-55q7 CVE-2023-32302 GHSA-36xx-7vf6-7mv3

Affected version: >=3.0.0,<4.13.14|>=5.0.0,<5.0.13

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] Business Logic Errors in SilverStripe Framework

PKSA-7j38-hj68-r82v CVE-2022-0227 GHSA-32m2-9f76-4gv8

Affected version: <4.10.1

Reported by:
GitHub

[MEDIUM] CVE-2020-26138 FormField: with square brackets in field name skips validation

PKSA-pq7g-1pwh-dw3n CVE-2020-26138 GHSA-7mv4-4xpg-xq44

Affected version: >=3.0.0,<4.0.0|>=4.0.0,<4.7.4

Reported by:
GitHub, FriendsOfPHP/security-advisories