npm

apostrophe

17 Total advisories

17 Vulnerabilities

0 Malware

Dependency scanning

Check whether apostrophe is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

apostrophe

Vulnerabilities

ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

Apostrophe has stored XSS via javascript: URL in Image Widget Link

Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS

ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API

ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint

ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context

ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Apostrophe CMS Insufficient Session Expiration vulnerability

Cross-site Scripting in apostrophe

Open Redirect in apostrophe

Denial of Service in apostrophe

Browse more npm advisories

Start Securing