Known vulnerabilities in Sulu

Vendor: Sulu GmbH
Software: Sulu
Software CPE: cpe:2.3:a:sulu_gmbh:sulu:*:*:*:*:*:*:*:*
Total vulnerabilities: 14
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Sulu Sulu is affected by 14 known vulnerabilities: 4 medium, 10 low Critical High Medium Low

Vulnerabilities (14)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU131128 - Improper Access Control
CWE-284 Low
No
No
2.6.23, 3.0.6 12.05.2026 SB2026050628
#VU131127 - Use of a Broken or Risky Cryptographic Algorithm
CVE-2026-45701
CWE-327 Low
No
No
2.6.23, 3.0.6 12.05.2026 SB2026050628
#VU131126 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-34372
CWE-288 Low
No
No
2.6.22, 3.0.5 12.05.2026 SB2026050628
#VU131125 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-47778
CWE-611 Low
No
No
2.5.25, 2.6.9, 3.0.0 14.05.2025 SB2026051226
#VU131124 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-47618
CWE-79 Low
No
No
2.6.5 03.10.2024 SB2024100360
#VU131123 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-47617
CWE-79 Medium
No
No
2.5.21, 2.6.5 03.10.2024 SB2024100360
#VU131121 - Improper Access Control
CVE-2024-27915
CWE-284 Low
No
No
2.4.17, 2.5.13 04.03.2024 SB2024030446
#VU131119 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2024-24807
CWE-80 Low
No
No
2.4.16, 2.5.12 05.02.2024 SB2024020556
#VU131116 - Observable Response Discrepancy
CVE-2023-39343
CWE-204 Medium
No
No
2.5.10 03.08.2023 SB2023080372
#VU131111 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2021-43836
CWE-98 Medium
No
No
1.6.44, 2.2.18, 2.3.8, 2.4.0 15.12.2021 SB2021121549
#VU131110 - Incorrect User Management
CVE-2021-43835
CWE-286 Low
No
No
2.2.18, 2.3.8, 2.4.0 15.12.2021 SB2021121549
#VU131112 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2021-41169
CWE-80 Low
No
No
1.6.43 21.10.2021 SB2021102156
#VU131114 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-32737
CWE-79 Low
No
No
1.6.41 02.07.2021 SB2021070222
#VU45639 - Exposure of sensitive information to an unauthorized actor
CVE-2020-15132
CWE-200 Medium
No
No
1.6.35, 2.0.10, 2.1.1 12.08.2020 SB2020081255