Vulnerabilidades de Six Apart Ltd.
CVEs publicadas que afetam produtos de Six Apart Ltd.: 11 registro(s), com severidade, exploração e correções.
Movable Type (Cloud Edition) 8Movable Type Premium (Cloud Edition) 8Movable Type (Software Edition) 6Movable Type Advanced (Software Edition) 6Movable Type Premium (Software Edition) 6Movable Type Premium (Advanced Edition) (Software Edition) 6Movable Type 5Movable Type Premium 5Movable Type Advanced 3Movable Type Premium (Advanced Edition) 3Movable Type Premium (MT8-based) 2
CVE-2026-96408
Crítica · 9.4
CWE-94 07/10/2026
Code Injection em Six Apart Ltd. Movable Type (Cloud Edition)
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
CVE-2026-103668
Alta · 8.6
CWE-89 07/10/2026
SQL Injection em Six Apart Ltd. Movable Type (Cloud Edition)
An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.
CVE-2026-44392
Média · 4.3
CWE-862 20/05/2026
Missing Authorization em Six Apart Ltd. Movable Type
Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.
CVE-2026-33088
Crítica · 9.8
CWE-89 08/04/2026
SQL Injection em Six Apart Ltd. Movable Type
Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.
CVE-2026-25776
Crítica · 9.8
CWE-94 08/04/2026
Code Injection em Six Apart Ltd. Movable Type
Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.
CVE-2026-24447
Média · 6.5
CWE-1236 04/02/2026
CSV Injection em Six Apart Ltd. Movable Type (Software Edition)
If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
CVE-2026-23704
Média · 6.5
CWE-434 04/02/2026
Unrestricted Upload of File with Dangerous Type em Six Apart Ltd. Movable Type (Software Edition)
A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
CVE-2026-22875
Média · 5.4
CWE-79 04/02/2026
Cross-site Scripting (XSS) em Six Apart Ltd. Movable Type (Software Edition)
Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
CVE-2026-21393
Média · 5.4
CWE-79 04/02/2026
Cross-site Scripting (XSS) em Six Apart Ltd. Movable Type (Software Edition)
Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
CVE-2025-62499
Média · 4.8
CWE-79 23/10/2025
Cross-site Scripting (XSS) em Six Apart Ltd. Movable Type (Software Edition)
Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page.
CVE-2025-54856
Média · 4.8
CWE-79 23/10/2025
Cross-site Scripting (XSS) em Six Apart Ltd. Movable Type (Software Edition)
Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.