Movable Type Cloud Edition
Monthly
Unauthenticated SQL injection in the Site Search function of Movable Type allows a remote attacker to run arbitrary SQL queries against the affected site's database, producing high confidentiality impact with limited integrity and availability impact (CVSS 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Affected deployments are Movable Type and Movable Type Premium (self-hosted) plus the Movable Type Cloud Edition and Premium Cloud Edition services from Six Apart Ltd. This is a genuine high-priority vulnerability: the CVSS vector confirms the attack is network-reachable with no privileges and no user interaction, so any instance exposing the standard public Site Search is in scope, although no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated code injection in the upgrade script shipped with Movable Type allows a remote attacker to execute an arbitrary Perl script or run an SQL query against the affected installation once the upgrade handler is reachable over the network. The flaw affects Movable Type, Movable Type Premium, and their Cloud Editions (Six Apart), and carries a critical severity rating (vendor CVSS 9.4; our assessment scores availability impact as High rather than Low, yielding CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, but the practical prerequisite is exposure of the installation/upgrade endpoint: sites that remove, restrict, or firewall the upgrade script after installation are substantially less reachable, while sites leaving it publicly accessible are directly exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the immediate risk is driven by mass internet exposure of the endpoint rather than by observed attacks.
Unauthenticated SQL injection in the Site Search function of Movable Type allows a remote attacker to run arbitrary SQL queries against the affected site's database, producing high confidentiality impact with limited integrity and availability impact (CVSS 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Affected deployments are Movable Type and Movable Type Premium (self-hosted) plus the Movable Type Cloud Edition and Premium Cloud Edition services from Six Apart Ltd. This is a genuine high-priority vulnerability: the CVSS vector confirms the attack is network-reachable with no privileges and no user interaction, so any instance exposing the standard public Site Search is in scope, although no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated code injection in the upgrade script shipped with Movable Type allows a remote attacker to execute an arbitrary Perl script or run an SQL query against the affected installation once the upgrade handler is reachable over the network. The flaw affects Movable Type, Movable Type Premium, and their Cloud Editions (Six Apart), and carries a critical severity rating (vendor CVSS 9.4; our assessment scores availability impact as High rather than Low, yielding CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, but the practical prerequisite is exposure of the installation/upgrade endpoint: sites that remove, restrict, or firewall the upgrade script after installation are substantially less reachable, while sites leaving it publicly accessible are directly exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the immediate risk is driven by mass internet exposure of the endpoint rather than by observed attacks.