Advisories · Technology
Ghost.
Every CVE that names Ghost among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
- Ghost
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch
- Ghost
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications
- Ghost
- Privilege escalation
- CVSS 5.3 Medium
Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery
- Ghost
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback
- Ghost
- Broken access control
- CVSS 8.6 High
Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
- Ghost
- Authentication bypass
- CVSS 5.3 Medium
Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token
- Ghost
- Race condition
- CVSS 5.3 Medium
Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API
- Ghost
- Information disclosure
- CVSS 6.9 Medium
Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint
- Ghost
- Information disclosure
- CVSS 7.6 High
Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
- Ghost
- Authentication bypass
- CVSS 8.5 High
Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe
- Ghost
- Path traversal
- CVSS 8.6 High
Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
- Ghost
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Ghost before 6.20.0 File Read via URL Encoding Bypass
- Ghost
- CWE-173
- CVSS 5.3 Medium
Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
- Ghost
- Information disclosure
- CVSS 6.9 Medium
Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read
- Ghost
- Broken access control
- CVSS 5.3 Medium
Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token
- Ghost
- Broken access control
- CVSS 8.7 High
Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
- Ghost
- Information disclosure
- CVSS 8.7 High
Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
- Ghost
- Broken access control
- CVSS 6.9 Medium
Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts
- Ghost
- Broken access control
- CVSS 8.7 High
Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset
- Ghost
- Broken access control
- CVSS 5.3 Medium
Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
- Ghost
- CWE-807
- CVSS 7.1 High
Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
- Ghost
- Broken access control
- CVSS 8.1 High
Ghost Foundation Ghost - Broken Access Control
- Ghost
- Broken access control
- CVSS 7.5 High
WordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerability
- Ghost
- Information disclosure
- CVSS 9.0 CriticalCritical · CVSS 9+
Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…
- Ghost
- CWE-453
- CVSS 9.0 CriticalCritical · CVSS 9+
Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…
- Ghost
- CWE-453
- CVSS 9.0 CriticalCritical · CVSS 9+
Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…
- Ghost
- CWE-453
- CVSS 9.0 CriticalCritical · CVSS 9+
Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…
- Ghost
- CWE-453
- CVSS 5.3 Medium
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4.
- Ghost
- CWE-204