Vulnerabilidades de Salesforce

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Salesforce: 13 registro(s), com severidade, exploração e correções.

Marketing Cloud Engagement 5 Mulesoft Anypoint Code Builder 3 Agentforce Vibes 3 Agentforce Vibes Extension 3 Workbench 1 Uni2ts 1

Somente exploradas (KEV) →

CVE-2026-34951 Média · 6.1 CWE-79 06/04/2026

Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions

Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains a reflected cross-site scripting vulnerability via the footerScripts parameter, which does not sanitize user-supplied input before rendering it in the page response. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Workbench allows XSS Targeting Error Pages. This vulnerability is fixed in 65.0.0.

CVE-2026-2298 Crítica · 9.4 CWE-88 23/03/2026

Argument Injection em Salesforce Marketing Cloud Engagement

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026.

CVE-2026-22586 Crítica · 9.8 CWE-321 23/01/2026

Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement…

Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.

CVE-2026-22585 Crítica · 9.8 CWE-327 23/01/2026

Use of a Broken or Risky Cryptographic Algorithm em Salesforce Marketing Cloud Engagement

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.

CVE-2026-22583 Crítica · 9.8 CWE-88 23/01/2026

Argument Injection em Salesforce Marketing Cloud Engagement

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.

CVE-2026-22582 Crítica · 9.8 CWE-88 23/01/2026

Argument Injection em Salesforce Marketing Cloud Engagement

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.

CVE-2026-22584 Crítica · 9.8 CWE-94 09/01/2026

Code Injection em Salesforce Uni2ts

Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.

CVE-2025-64322 Média · 5.3 CWE-732 04/11/2025

Incorrect Permission Assignment for Critical Resource em Salesforce Agentforce Vibes

Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0.

CVE-2025-64321 Média · 5.3 CWE-94 04/11/2025

Code Injection em Salesforce Agentforce Vibes

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0.

CVE-2025-64320 Média · 6.5 CWE-94 04/11/2025

Code Injection em Salesforce Agentforce Vibes

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0.

CVE-2025-64319 Média · 5.3 CWE-732 04/11/2025

Incorrect Permission Assignment for Critical Resource em Salesforce Mulesoft Anypoint Code Builder

Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1

CVE-2025-64318 Média · 5.3 CWE-94 04/11/2025

Code Injection em Salesforce Mulesoft Anypoint Code Builder

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1.

CVE-2025-10875 Média · 6.5 CWE-94 04/11/2025

Code Injection em Salesforce Mulesoft Anypoint Code Builder

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mulesoft Anypoint Code Builder: before 1.11.6.