CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-5715
https://notcve.org/view.php?id=CVE-2019-5715
11 Apr 2019 — All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject. SilverStripe 3 todas las versiones anteriores a 3.6.7 y 3.7.3, y SilverStripe 4 todas las versiones anteriores a 4.0.7, 4.1.5, 4.2.4 y 4.3.1 permiten la inyección SQL reflejada por medio de los componentes Form y DataObject. • https://www.silverstripe.org/download/security-releases • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2017-18049
https://notcve.org/view.php?id=CVE-2017-18049
23 Jan 2018 — In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software (including Microsoft Excel). For example, the CSV data may contain untrusted user input from the "First Name" field of a user's /myprofile page. En la característica de exportación CSV de SilverStripe, en versiones anteriores a la 3.5.6, versiones 3.6.x anteriores a la 3.6.3 y ... • https://www.exploit-db.com/exploits/43396 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •