VulertSecurity VulertSecurity

Vulnerability Database · PyPI · plone · Version

plone 5.2.0rc2

5.2.0rc2 is affected by 53 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 6.2.2.

Critical 2 High 9 Medium 19 Low 0 Unrated 23

All plone versions & vulnerabilities → Search the database for this package →
Released 22 Mar 2019 Licence GPL-2.0 Also known from other sources 41 Newer releases 207 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

plone 5.2.0rc2 vulnerabilities

53 vulnerabilities cover plone 5.2.0rc2. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2021-33509: Incorrect Permission Assignment for Critical Resource in Plone 9.9 critical 5.2.5 15 Jun 2021
CVE-2020-7941: Plone Unauthenticated Write Vulnerability 9.8 critical No fix published 24 May 2022
CVE-2021-33926: Server-Side Request Forgery in Plone CMS 8.8 high 5.2.5 17 Feb 2023
CVE-2021-33926: Plone CMS Sensitive Information Exposure via RSS Feed 8.8 high 5.2.5 17 Feb 2023
CVE-2020-7939: Plone SQL Injection Vulnerability 8.8 high No fix published 24 May 2022
CVE-2020-28736: Improper Restriction of XML External Entity Reference in Plone 8.8 high 5.2.3 07 Apr 2021
CVE-2020-28735: SSRF attacks via tracebacks in Plone 8.8 high 5.2.3 07 Apr 2021
CVE-2020-28734: Improper Restriction of XML External Entity Reference in Plone 8.8 high 5.2.3 07 Apr 2021
CVE-2021-33511: Server-Side Request Forgery in Plone 7.5 high No fix published 15 Jun 2021
CVE-2024-0669: Plone CMS Cross-Frame Scripting Vulnerability 7.1 high 6.0.7 07 Jul 2026
Cross-Frame Scripting Vulnerability in Plone CMS 7.1 high 6.0.7 18 Jan 2024
CVE-2021-35959: Stored XSS in Plone folder contents 6.1 medium No fix published 24 May 2022
CVE-2021-3313: Plone XSS in User Fullname Property and File Upload 6.1 medium 5.2.4 24 May 2022
CVE-2016-7137: Plone Open Redirect Vulnerability 6.1 medium No fix published 14 May 2022
CVE-2016-7136: Plone XSS 6.1 medium No fix published 14 May 2022
CVE-2016-7138: Plone XSS 6.1 medium No fix published 14 May 2022
CVE-2024-22889: Plone Phone Information Disclosure Vulnerability 5.5 medium No fix published 07 Jul 2026
CVE-2024-22889: Phone information disclosure vulnerability in Plone 5.5 medium No fix published 06 Mar 2024
CVE-2020-7937: XSS Vulnerability in Plone 5.4 medium No fix published 24 May 2022
Plone cross site scripting (XSS) 5.4 medium No fix published 24 May 2022
CVE-2021-33508: Cross-site scripting in Plone 5.4 medium No fix published 08 Jun 2021
CVE-2021-33512: Cross-site scripting in Plone 5.4 medium No fix published 08 Jun 2021
CVE-2021-33513: Cross-site scripting in Plone 5.4 medium No fix published 08 Jun 2021
CVE-2021-29002: Plone CMS 5.2.3 Stored XSS Vulnerability in Site Control Panel 5.4 medium No fix published 24 Mar 2021
CVE-2013-4189: Plone Privilege Escalation 4.9 medium No fix published 17 May 2022
CVE-2016-4043: Chameleon in Plone allows Authentication Bypass 4.9 medium No fix published 17 May 2022
CVE-2013-4198: Plone - Authenticated Users Able to Alter Password Despite Policy Definition 4.3 medium No fix published 17 May 2022
CVE-2021-33510: Server-Side Request Forgery in Plone 4.3 medium No fix published 15 Jun 2021
CVE-2008-1396: Plone CMS 3.1.x Authentication Cookie Vulnerability N/A unrated No fix published 02 Jul 2026
CVE-2021-29002: Plone XSS Vulnerability N/A medium No fix published 24 May 2022
CVE-2008-1396: Plone credentials stored in session cookie N/A medium No fix published 01 May 2022
CVE-2021-35959: XSS Vulnerability in Plone N/A unrated 5.2.5 30 Jun 2021
CVE-2021-33510: SSRF vulnerability in Plone N/A unrated 5.2.5 21 May 2021
CVE-2021-33507: Reflected XSS in Zope Products.CMFCore and Products.PluggableAuthService N/A unrated 5.2.5 21 May 2021
CVE-2021-33508: XSS Vulnerability in Plone N/A unrated 5.2.5 21 May 2021
CVE-2021-33513: XSS vulnerability in Plone N/A unrated 5.2.5 21 May 2021
CVE-2021-33512: Stored XSS attacks in Plone through 5.2.4 N/A unrated 5.2.5 21 May 2021
CVE-2021-33511: SSRF Vulnerability in Plone N/A unrated 5.2.5 21 May 2021
CVE-2021-33509: Plone Remote Authenticated Managers Disk I/O Vulnerability N/A unrated 5.2.5 21 May 2021
CVE-2021-3313: Stored Cross-Site Scripting (XSS) in Plone CMS N/A unrated 5.2.4 20 May 2021
CVE-2020-28734: XXE attacks in Plone before 5.2.3 N/A unrated 5.2.3 30 Dec 2020
CVE-2020-28735: SSRF attacks in Plone before 5.2.3 N/A unrated 5.2.3 30 Dec 2020
CVE-2020-28736: XXE attacks in Plone before 5.2.3 N/A unrated 5.2.3 30 Dec 2020
CVE-2020-7937: XSS Vulnerability in Plone N/A unrated 5.2.2 23 Jan 2020
CVE-2020-7936: Open Redirect Vulnerability in Plone N/A unrated 5.2.2 23 Jan 2020
CVE-2020-7939: SQL Injection in Plone N/A unrated 5.2.2 23 Jan 2020
CVE-2020-7940: Weak Password Strength Checks in Plone N/A unrated 5.2.1 23 Jan 2020
CVE-2020-7941: Privilege Escalation in plone.app.contenttypes N/A unrated 5.2.2 23 Jan 2020
CVE-2011-2528: Plone Package Privilege Escalation Vulnerability N/A unrated No fix published 19 Jul 2011
CVE-2009-0662: Plone Package Vulnerability Allows Identity Acquisition of Arbitrary Users N/A unrated No fix published 23 Apr 2009
CVE-2008-0164: Plone CMS Cross-Site Request Forgery Vulnerabilities N/A unrated No fix published 20 Mar 2008
CVE-2006-4249: Plone Package Vulnerability Allows Group Masquerading N/A unrated No fix published 07 Dec 2006
CVE-2006-4247: Plone Password Reset Tool Vulnerability Allows Unauthorized Password Resets N/A unrated No fix published 29 Sep 2006

Looking for another version, or everything Vulert holds for plone?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About plone 5.2.0rc2

Is plone 5.2.0rc2 vulnerable?

Yes. 53 vulnerabilities in the Vulert database cover plone 5.2.0rc2: 2 critical, 9 high, 19 medium and 0 low, plus 23 not yet rated. The upgrade Vulert recommends is 6.2.2, and each entry above names the fixed version to move to.

Which version of plone should I use instead of 5.2.0rc2?

6.2.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 5.2.0rc2 the latest release of plone?

No. 5.2.0rc2 was published 22 Mar 2019, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor plone for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the plone version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.