Six Apart vulnerabilities
We track 4 vulnerabilities in Six Apart products across 5 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 7, 2026.
Latest Six Apart vulnerabilities
- 9.3 Critical severity
Movable Type Cloud Edition: Improper Control of Generation of Code
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
- 8.8 High severity
Movable Type Cloud Edition: Improper Neutralization of Special Elements used in an SQL Command
An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.
- 7.2 High severity
Movable Type: Improper Control of Generation of Code
Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected prod
- 9.8 Critical severity
Movable Type XMLRPC API: Improper Control of Generation of Code
Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed