Known vulnerabilities in Movable Type

Software: Movable Type
Software CPE: cpe:2.3:a:six_apart:movable_type:*:*:*:*:*:*:*:*
Total vulnerabilities: 44
Public exploits: 4
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Movable Type Movable Type is affected by 44 known vulnerabilities: 4 high, 12 medium, 28 low Critical High Medium Low

Vulnerabilities (44)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU125193 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-33088
CWE-89 High
No
No
8.0.10, 8.8.3, 9.0.7, 9.1.1 08.04.2026 SB2026040846
#VU125192 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-25776
CWE-94 High
No
No
8.0.10, 8.8.3, 9.0.7, 9.1.1 08.04.2026 SB2026040846
#VU122296 - Improper Neutralization of Formula Elements in a CSV File
CVE-2026-24447
CWE-1236 Medium
No
No
8.0.9, 8.8.2, 9.0.6 04.02.2026 SB2026020430
#VU122294 - Unrestricted Upload of File with Dangerous Type
CVE-2026-23704
CWE-434 Medium
No
No
8.0.9, 8.8.2, 9.0.6 04.02.2026 SB2026020430
#VU122292 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-22875
CWE-79 Low
No
No
8.0.9, 8.8.2, 9.0.6 04.02.2026 SB2026020430
#VU122291 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-21393
CWE-79 Low
No
No
8.0.9, 8.8.2, 9.0.6 04.02.2026 SB2026020430
#VU117532 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62499
CWE-79 Low
No
No
r.5510, 8.0.8, 8.4.4, 8.8.0 22.10.2025 SB20251022153
#VU117530 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-54856
CWE-79 Low
No
No
r.5510, 8.0.8, 8.4.4, 8.8.0 22.10.2025 SB20251022153
#VU114233 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2025-55706
CWE-601 Medium
No
No
r.5509, 8.0.0, 8.4.3 20.08.2025 SB2025082007
#VU114232 - Use of Less Trusted Source
CVE-2025-53522
CWE-348 Medium
No
No
r.5509, 8.0.0, 8.4.3 20.08.2025 SB2025082007
#VU104052 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-25054
CWE-79 Low
No
No
8.0.6, 8.4.2 19.02.2025 SB202502197121
#VU104051 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-24841
CWE-79 Low
No
No
8.0.6, 8.4.2 19.02.2025 SB202502197121
#VU104050 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-22888
CWE-79 Low
No
No
8.0.6, 8.4.2 19.02.2025 SB202502197121
#VU82357 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-45746
CWE-79 Low
No
No
r.5501 25.10.2023 SB2023102507
#VU69360 - Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
CVE-2022-43660
CWE-97 Low
No
No
r.5401 16.11.2022 SB2022111605
#VU69359 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-45122
CWE-79 Low
No
No
r.5401, 6.8.8 16.11.2022 SB2022111605
#VU69357 - Improper input validation
CVE-2022-45113
CWE-20 Medium
No
No
r.5401, 6.8.8 16.11.2022 SB2022111605
#VU66754 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-38078
CWE-78 High
No
No
r.5301, 6.8.7 25.08.2022 SB2022082506
#VU57555 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-20837
CWE-78 High
Available
No
r.5003, 6.8.3 20.10.2021 SB2021102007
#VU56073 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-20814
CWE-79 Low
No
No
7.8.0 25.08.2021 SB2021082502


Showing elements 1 - 20 out of 44