Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

PYSEC-2026-2965 | Mondoo Vulnerability Intelligence

Vulnerability IntelligencePYSEC-2026-2965

PYSEC-2026-2965

HIGH8.3

PYSEC-2026-2965

Published Jul 9, 2026

Modified 3 months ago

Fix available

Details

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Affected Packages

products-cmfplone

PyPI

Affected versions:

4.0b14.1a14.1a24.1a34.1b14.1b24.1rc2

Fixed in:

4.0.74.1rc3

References

http://plone.org/products/plone/security/advisories/CVE-2011-1948

https://access.redhat.com/errata/RHSA-2012:0151

https://access.redhat.com/security/cve/CVE-2011-1948

https://bugzilla.redhat.com/show_bug.cgi?id=711494

https://exchange.xforce.ibmcloud.com/vulnerabilities/67693

https://github.com/advisories/GHSA-p7h9-vf92-5fj5

https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-14.yaml

https://nvd.nist.gov/vuln/detail/CVE-2011-1948

https://pypi.org/project/products-cmfplone

Aliases

CVE-2011-1948 GHSA-p7h9-vf92-5fj5

CVSS Analysis

CVSS v4.0

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

PassiveUI:P

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

NoneVI:N

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

LowSC:L

Subseq. Integrity

LowSI:L

Subseq. Availability

NoneSA:N

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Related

Ecosystems

Timeline

PublishedJul 9, 2026

ModifiedJul 13, 2026