Six Apart Ltd. vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Six Apart Ltd. products: 11 record(s), with severity, exploitation and fixes.

Movable Type (Cloud Edition) 8 Movable Type Premium (Cloud Edition) 8 Movable Type (Software Edition) 6 Movable Type Advanced (Software Edition) 6 Movable Type Premium (Software Edition) 6 Movable Type Premium (Advanced Edition) (Software Edition) 6 Movable Type 5 Movable Type Premium 5 Movable Type Advanced 3 Movable Type Premium (Advanced Edition) 3 Movable Type Premium (MT8-based) 2

Exploited only (KEV) →

CVE-2026-96408 Critical · 9.4 CWE-94 Oct 7, 2026

Code Injection in Six Apart Ltd. Movable Type (Cloud Edition)

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

CVE-2026-103668 High · 8.6 CWE-89 Oct 7, 2026

SQL Injection in Six Apart Ltd. Movable Type (Cloud Edition)

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.

CVE-2026-44392 Medium · 4.3 CWE-862 May 20, 2026

Missing Authorization in Six Apart Ltd. Movable Type

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.

CVE-2026-33088 Critical · 9.8 CWE-89 Apr 8, 2026

SQL Injection in Six Apart Ltd. Movable Type

Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.

CVE-2026-25776 Critical · 9.8 CWE-94 Apr 8, 2026

Code Injection in Six Apart Ltd. Movable Type

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.

CVE-2026-24447 Medium · 6.5 CWE-1236 Feb 4, 2026

CSV Injection in Six Apart Ltd. Movable Type (Software Edition)

If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

CVE-2026-23704 Medium · 6.5 CWE-434 Feb 4, 2026

Unrestricted Upload of File with Dangerous Type in Six Apart Ltd. Movable Type (Software Edition)

A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

CVE-2026-22875 Medium · 5.4 CWE-79 Feb 4, 2026

Cross-site Scripting (XSS) in Six Apart Ltd. Movable Type (Software Edition)

Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

CVE-2026-21393 Medium · 5.4 CWE-79 Feb 4, 2026

Cross-site Scripting (XSS) in Six Apart Ltd. Movable Type (Software Edition)

Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

CVE-2025-62499 Medium · 4.8 CWE-79 Oct 23, 2025

Cross-site Scripting (XSS) in Six Apart Ltd. Movable Type (Software Edition)

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page.

CVE-2025-54856 Medium · 4.8 CWE-79 Oct 23, 2025

Cross-site Scripting (XSS) in Six Apart Ltd. Movable Type (Software Edition)

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.