Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

sulu — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in sulu, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting the Sulu content management system, categorized by specific weakness types and relevant security tags. The collection encompasses a comprehensive history of reported flaws ranging from early development releases to the most recent stable versions, covering a time span that includes all publicly disclosed incidents since the product's inception. Users can utilize this resource to track official advisories issued by the Sulu vendor, analyze the characteristics of a particular weakness class such as cross-site scripting or improper access control, and review the complete vulnerability history of the Sulu platform to assess long-term security trends. The data presented here serves as a centralized reference for security researchers, system administrators, and developers seeking to understand the risk landscape associated with Sulu deployments without navigating fragmented external sources. By consolidating these details, the page facilitates efficient impact analysis and helps organizations prioritize remediation efforts based on the severity and prevalence of identified issues within the Sulu ecosystem.

Vendor: sulu

CVE ID Title CVSS Severity Published
CVE-2026-92692 Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) CWE-89 6.9 Medium 2026-09-23
CVE-2026-82396 Sulu: Stored XSS via media download inline-disposition override CWE-79 5.4 Medium 2026-08-31
CVE-2026-82395 Sulu: Media move/update authorization bypass (IDOR) CWE-639 5.3 Medium 2026-08-31
CVE-2026-82394 Sulu: Fix authorization bypass when creating preview links CWE-862 5.3 Medium 2026-08-31
CVE-2026-45701 Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens CWE-327 - - 2026-06-01
CVE-2026-34372 Sulu checks fix permissions for subentities endpoints CWE-288 4.3 - 2026-03-31
CVE-2025-47778 Sulu vulnerable to XXE in SVG File upload Inspector CWE-611 3.8AI Low AI 2025-05-14
CVE-2024-47617 Reflected XSS Vulnerability in Sulu Media Bundle CWE-79 6.1 Medium 2024-10-03
CVE-2024-47618 Sulu vulnerable to XSS via uploaded SVG CWE-79 5.4 - 2024-10-03
CVE-2024-27915 Sulu grants access to pages regardless of role permissions CWE-863 6.8 Medium 2024-03-06
CVE-2024-24807 Sulu is vulnerable to HTML Injection via Autocomplete Suggestion CWE-80 2.7 Low 2024-02-05
CVE-2023-39343 Sulu Observable Response Discrepancy on Admin Login CWE-204 4.3 Medium 2023-08-04
CVE-2021-43836 PHP file inclusion in the Sulu admin panel CWE-22 8.5 High 2021-12-15
CVE-2021-43835 Privilege escalation in the Sulu Admin panel CWE-269 7.2 High 2021-12-15
CVE-2021-41169 Improper Neutralization HTML tags in sulu/sulu CWE-79 6.2 Medium 2021-10-21
CVE-2021-32737 XSS Injection in Media Collection Title was possible CWE-79 8.4 High 2021-07-02
CVE-2020-15132 Reset Password / Login vulnerability in Sulu CWE-209 5.3 Medium 2020-08-05

All 17 known CVE vulnerabilities affecting sulu with full Chinese analysis, references, and POCs where available.