Known vulnerabilities in Movable Type Premium

Vendor: Six Apart Ltd
Software: Movable Type Premium
Software CPE: cpe:2.3:a:six_apart:movable_type_premium:*:*:*:*:*:*:*:*
Website: https://movabletype.com
Total vulnerabilities: 33
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Movable Type Premium Movable Type Premium is affected by 33 known vulnerabilities: 4 high, 7 medium, 22 low Critical High Medium Low

Vulnerabilities (33)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU125193 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-33088		 CWE-89 High
No
No
 2.15, 9.0.7, 9.1.1 08.04.2026 SB2026040846
#VU125192 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-25776		 CWE-94 High
No
No
 2.15, 9.0.7, 9.1.1 08.04.2026 SB2026040846
#VU122296 - Improper Neutralization of Formula Elements in a CSV File
CVE-2026-24447		 CWE-1236 Medium
No
No
 2.14, 9.1.0 04.02.2026 SB2026020430
#VU122294 - Unrestricted Upload of File with Dangerous Type
CVE-2026-23704		 CWE-434 Medium
No
No
 2.14, 9.1.0 04.02.2026 SB2026020430
#VU122292 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-22875		 CWE-79 Low
No
No
 2.14, 9.1.0 04.02.2026 SB2026020430
#VU122291 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-21393		 CWE-79 Low
No
No
 2.14, 9.1.0 04.02.2026 SB2026020430
#VU117532 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62499		 CWE-79 Low
No
No
 1.68, 2.11 22.10.2025 SB20251022153
#VU117530 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-54856		 CWE-79 Low
No
No
 1.68, 2.11 22.10.2025 SB20251022153
#VU114233 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2025-55706		 CWE-601 Medium
No
No
 1.67, 2.10 20.08.2025 SB2025082007
#VU114232 - Use of Less Trusted Source
CVE-2025-53522		 CWE-348 Medium
No
No
 1.67, 2.10 20.08.2025 SB2025082007
#VU104052 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-25054		 CWE-79 Low
No
No
 2.07 19.02.2025 SB202502197121
#VU104051 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-24841		 CWE-79 Low
No
No
 2.07 19.02.2025 SB202502197121
#VU104050 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-22888		 CWE-79 Low
No
No
 2.07 19.02.2025 SB202502197121
#VU82357 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-45746		 CWE-79 Low
No
No
 1.59 25.10.2023 SB2023102507
#VU69360 - Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
CVE-2022-43660		 CWE-97 Low
No
No
 1.54 16.11.2022 SB2022111605
#VU69359 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-45122		 CWE-79 Low
No
No
 1.54 16.11.2022 SB2022111605
#VU69357 - Improper input validation
CVE-2022-45113		 CWE-20 Medium
No
No
 1.54 16.11.2022 SB2022111605
#VU66754 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-38078		 CWE-78 High
No
No
 1.53 25.08.2022 SB2022082506
#VU57555 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-20837		 CWE-78 High
Available
No
 1.47 20.10.2021 SB2021102007
#VU56065 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-20808		 CWE-79 Low
No
No
 - 25.08.2021 SB2021082502


Showing elements 1 - 20 out of 33