https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-33098.htmlhttps://patchthecve.com/cve/CVE-2022-33098.htmlThu, 09 Jul 2026 01:17:32 +0000MEDIUM 6.1: Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted SVG document, with JavaScript, for a profile picture.https://patchthecve.com/cve/CVE-2021-46366.htmlhttps://patchthecve.com/cve/CVE-2021-46366.htmlWed, 17 Jun 2026 04:14:48 +0000HIGH 8.8: An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.https://patchthecve.com/cve/CVE-2021-46365.htmlhttps://patchthecve.com/cve/CVE-2021-46365.htmlWed, 17 Jun 2026 04:14:48 +0000HIGH 7.8: An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.https://patchthecve.com/cve/CVE-2021-46364.htmlhttps://patchthecve.com/cve/CVE-2021-46364.htmlWed, 17 Jun 2026 04:14:48 +0000HIGH 7.8: A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.https://patchthecve.com/cve/CVE-2021-46363.htmlhttps://patchthecve.com/cve/CVE-2021-46363.htmlWed, 17 Jun 2026 04:14:48 +0000HIGH 7.8: An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported files with Microsoft Excel.https://patchthecve.com/cve/CVE-2021-46362.htmlhttps://patchthecve.com/cve/CVE-2021-46362.htmlWed, 17 Jun 2026 04:14:48 +0000CRITICAL 9.8: A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter.https://patchthecve.com/cve/CVE-2021-46361.htmlhttps://patchthecve.com/cve/CVE-2021-46361.htmlWed, 17 Jun 2026 04:14:48 +0000CRITICAL 9.8: An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.https://patchthecve.com/cve/CVE-2021-25894.htmlhttps://patchthecve.com/cve/CVE-2021-25894.htmlWed, 17 Jun 2026 03:42:32 +0000MEDIUM 6.1: Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter.https://patchthecve.com/cve/CVE-2021-25893.htmlhttps://patchthecve.com/cve/CVE-2021-25893.htmlWed, 17 Jun 2026 03:42:32 +0000MEDIUM 5.4: Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of /magnoliaAuthor/.magnolia/.