sulu vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20214
3. 20231
4. 20245
5. 20251
6. 20266

Newest CVEs

• CVE-2026-92692

  Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

  sulu · sulu

  Medium6.9
• CVE-2026-82396

  Sulu: Stored XSS via media download inline-disposition override

  sulu · sulu

  Medium5.4
• CVE-2026-82395

  Sulu: Media move/update authorization bypass (IDOR)

  sulu · sulu

  Medium5.3
• CVE-2026-82394

  Sulu: Fix authorization bypass when creating preview links

  sulu · sulu

  Medium5.3
• CVE-2026-45701

  Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

  sulu · sulu

  Medium6.9
• CVE-2026-34372

  Sulu checks fix permissions for subentities endpoints

  sulu · sulu

  Medium5.3
• CVE-2025-47778

  Sulu vulnerable to XXE in SVG File upload Inspector

  sulu · sulu

  Medium6.1
• CVE-2024-47617

  Reflected XSS Vulnerability in Sulu Media Bundle

  sulu · sulu

  Medium6.1
• CVE-2024-47618

  Sulu vulnerable to XSS via uploaded SVG

  sulu · sulu

  Medium5.1
• CVE-2024-37156

  TokenController formName not sanitized in hidden input

  sulu · SuluFormBundle

  Medium6.1