Movabletype
Movabletype Movable Type: vulnerabilidades y CVE
Movabletype Movable Type tiene 15 vulnerabilidades publicadas, 6 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE15
Últimos 12 meses6
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-44392 | Media (5.3) | 0.33% | — | 20 may 2026 | Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed. |
| CVE-2026-23704 | Media (5.1) | 0.21% | — | 4 feb 2026 | A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4… |
| CVE-2026-22875 | Media (4.8) | 0.22% | — | 4 feb 2026 | Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7… |
| CVE-2026-21393 | Media (4.8) | 0.22% | — | 4 feb 2026 | Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7… |
| CVE-2025-62499 | Media (4.6) | 0.23% | — | 23 oct 2025 | Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be… |
| CVE-2025-54856 | Media (4.6) | 0.23% | — | 23 oct 2025 | Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the… |
| CVE-2025-55706 | Media (5.1) | 0.20% | — | 20 ago 2025 | URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to… |
| CVE-2025-53522 | Media (6.9) | 0.18% | — | 20 ago 2025 | Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker. |
| CVE-2025-25054 | Media (6.1) | 0.26% | — | 19 feb 2025 | Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the… |
| CVE-2025-24841 | Media (5.4) | 0.22% | — | 19 feb 2025 | Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a… |
| CVE-2025-22888 | Media (5.4) | 0.22% | — | 19 feb 2025 | Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user's web browser. |
| CVE-2021-20665 | Media (6.1) | 0.84% | — | 5 mar 2021 | Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series),… |
| CVE-2021-20664 | Media (6.1) | 0.84% | — | 5 mar 2021 | Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type… |
| CVE-2021-20663 | Media (6.1) | 0.84% | — | 5 mar 2021 | Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable… |
| CVE-2005-3102 | Media (5) | 1.1% | — | 28 sept 2005 | The administrative interface in Movable Type allows attackers to upload files with arbitrary extensions under the web root. |