apostrophecms
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 29 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from January 23, 2020 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
ApostropheCMS: Import API bypasses publication roles for protected content
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
Monitor apostrophecms in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.