Silverstripe vulnerabilities
We track 4 vulnerabilities in Silverstripe products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 27, 2026.
Latest Silverstripe vulnerabilities
- 8.8 High severity
silverstripe-userforms: Improper Control of Generation of Code
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-sid
- 7.2 High severity
silverstripe-advancedworkflow: Improper Neutralization of Special Elements Used in a Template Engine
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in Notif
- 7.5 High severity
silverstripe-graphql: Uncontrolled Resource Consumption
silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with pu
- 7.5 High severity
silverstripe-graphql: Allocation of Resources Without Limits or Throttling
`silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoi