CVE-2015-8606: Silverstripe

Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.

Affected products

• Silverstripe Silverstripe: up to and including 3.1.15; version 3.2.0 only

Published 2016-04-13. Last modified 2026-06-17.