Orchard
Monthly
Improper authorization in Orchard CMS 1.10.3 through 1.11 allows authenticated users holding the Author or Contributor role to display, clone and delete other users' media items by referencing their content ids, and to delete arbitrary media folders through FolderController.Delete(), because the media folder permission check never validates ownership. Exploitation requires a valid low-privilege account (CVSS 4.0 score 7.1 with PR:L), so anonymous or unauthenticated visitors cannot trigger it; risk is confined to multi-user sites that provision Author/Contributor accounts for semi-trusted people. A public technical write-up describing the issue exists but is not verified as working exploit code, and no CISA KEV entry or vendor-released fixed version appears in the available data.
Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 15.8%.
Cross-site scripting (XSS) vulnerability in the Orchard.Comments module in Orchard before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Improper authorization in Orchard CMS 1.10.3 through 1.11 allows authenticated users holding the Author or Contributor role to display, clone and delete other users' media items by referencing their content ids, and to delete arbitrary media folders through FolderController.Delete(), because the media folder permission check never validates ownership. Exploitation requires a valid low-privilege account (CVSS 4.0 score 7.1 with PR:L), so anonymous or unauthenticated visitors cannot trigger it; risk is confined to multi-user sites that provision Author/Contributor accounts for semi-trusted people. A public technical write-up describing the issue exists but is not verified as working exploit code, and no CISA KEV entry or vendor-released fixed version appears in the available data.
Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 15.8%.
Cross-site scripting (XSS) vulnerability in the Orchard.Comments module in Orchard before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.