Oroinc: >> Oroplatform >> 5.1.0 Security Vulnerabilities
A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.
CVSS Score
6.1
EPSS Score
0.008
Published
2024-12-06
OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinned pages of other users by pageId hash. This vulnerability is fixed in 5.1.4.
CVSS Score
4.3
EPSS Score
0.002
Published
2024-03-25
OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.
CVSS Score
4.3
EPSS Score
0.002
Published
2024-03-25
OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1.
CVSS Score
5.0
EPSS Score
0.002
Published
2023-11-27