Components Vulnerabilities Pricing MCP API

processwire/processwire 3.0.39 | Vulnerabi… | Sonatype Guide

processwire

3.0.39

processwire 3.0.39

processwire

PublishedNov 2, 2016•Policy

compliance

composer Registry

Developer Trust Score

N/A

Recommended Version:x.y.z

Latest version with 0 known vulnerabilities that meets your policy.

Compare Versions

Severity

Critical (0)

High (0)

Medium (15)

Low (0)

CVSS Score

0.010.0

EPSS Score

0.01.0

Malware

KEV StatusPublished

6.5CVE-2025-60790

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.

PublishedOct 22, 2025

5.3CVE-2024-41597

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality.

PublishedJul 22, 2024

6.1CVE-2023-28439

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.

6.5CVE-2022-40488

ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).

PublishedNov 1, 2022

6.1CVE-2022-40487

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload.

PublishedNov 1, 2022

6.1CVE-2019-11358

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

6.1CVE-2021-33829

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

PublishedJun 10, 2021

6.5CVE-2021-26271

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).

PublishedJan 27, 2021

6.1CVE-2020-7656

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

6.1CVE-2020-11023EXPLOITED

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

6.1sonatype-2020-0187

jQuery - Cross-Site Scripting (XSS)

6.1sonatype-2020-0066

CKEditor - Cross-Site Scripting (XSS) [CVE-2020-9440]

PublishedMar 9, 2020

6.5sonatype-2014-0026

jQuery - Cross-Site Scripting (XSS)

6.1sonatype-2016-0107

jQuery - Cross-Site Scripting (XSS) [CVE-2015-9251]

6.1sonatype-2012-0009

JQuery - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

SeverityMedium

PublishedMar 23, 2023

Published

Jul 29, 2022

Published

May 21, 2020

PublishedApr 30, 2020

Apr 14, 2020

Mar 28, 2017

Published

Mar 28, 2017

Published

Mar 28, 2017