Movable Type Premium
Monthly
Unauthenticated SQL injection in the Site Search function of Movable Type allows a remote attacker to run arbitrary SQL queries against the affected site's database, producing high confidentiality impact with limited integrity and availability impact (CVSS 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Affected deployments are Movable Type and Movable Type Premium (self-hosted) plus the Movable Type Cloud Edition and Premium Cloud Edition services from Six Apart Ltd. This is a genuine high-priority vulnerability: the CVSS vector confirms the attack is network-reachable with no privileges and no user interaction, so any instance exposing the standard public Site Search is in scope, although no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated code injection in the upgrade script shipped with Movable Type allows a remote attacker to execute an arbitrary Perl script or run an SQL query against the affected installation once the upgrade handler is reachable over the network. The flaw affects Movable Type, Movable Type Premium, and their Cloud Editions (Six Apart), and carries a critical severity rating (vendor CVSS 9.4; our assessment scores availability impact as High rather than Low, yielding CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, but the practical prerequisite is exposure of the installation/upgrade endpoint: sites that remove, restrict, or firewall the upgrade script after installation are substantially less reachable, while sites leaving it publicly accessible are directly exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the immediate risk is driven by mass internet exposure of the endpoint rather than by observed attacks.
Missing authorization in Movable Type allows authenticated non-administrator users to trigger unintended update operations under certain conditions. Affecting Movable Type, Movable Type Advanced, and Movable Type Premium products by Six Apart Ltd., the flaw (CWE-862) permits a low-privileged user to bypass access controls and perform write operations that should be restricted to administrators. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a fix in version 9.0.8 on 2026-05-20 per the Six Apart advisory.
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated SQL injection in the Site Search function of Movable Type allows a remote attacker to run arbitrary SQL queries against the affected site's database, producing high confidentiality impact with limited integrity and availability impact (CVSS 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Affected deployments are Movable Type and Movable Type Premium (self-hosted) plus the Movable Type Cloud Edition and Premium Cloud Edition services from Six Apart Ltd. This is a genuine high-priority vulnerability: the CVSS vector confirms the attack is network-reachable with no privileges and no user interaction, so any instance exposing the standard public Site Search is in scope, although no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated code injection in the upgrade script shipped with Movable Type allows a remote attacker to execute an arbitrary Perl script or run an SQL query against the affected installation once the upgrade handler is reachable over the network. The flaw affects Movable Type, Movable Type Premium, and their Cloud Editions (Six Apart), and carries a critical severity rating (vendor CVSS 9.4; our assessment scores availability impact as High rather than Low, yielding CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, but the practical prerequisite is exposure of the installation/upgrade endpoint: sites that remove, restrict, or firewall the upgrade script after installation are substantially less reachable, while sites leaving it publicly accessible are directly exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the immediate risk is driven by mass internet exposure of the endpoint rather than by observed attacks.
Missing authorization in Movable Type allows authenticated non-administrator users to trigger unintended update operations under certain conditions. Affecting Movable Type, Movable Type Advanced, and Movable Type Premium products by Six Apart Ltd., the flaw (CWE-862) permits a low-privileged user to bypass access controls and perform write operations that should be restricted to administrators. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a fix in version 9.0.8 on 2026-05-20 per the Six Apart advisory.
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.