CVE-2020-7939: Plone

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)

Affected products

• Plone Plone: from 4.0.0, up to and including 5.2.1

Published 2020-01-23. Last modified 2026-06-17.