jupo 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
公開された問題は vendor risk cross-site scripting に関連することが多く、vendor surface production workloads and vendor surface software deployment の文脈で vendor impact session compromise などの暴露リスクを伴う場合があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2025-50481 | A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post. | [email protected] | 4.8 | 0.28% | 2025-07-23 | 2025-07-28 |
| CVE-2025-6050 | Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/adm | 596c5446-0ce5-4ba2-aa66-48b3b757a647 | 4.8 | 0.08% | 2025-06-17 | 2025-07-30 |
| CVE-2025-29573 | Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module. | [email protected] | 6.1 | 0.18% | 2025-05-05 | 2025-06-16 |
| CVE-2024-25170 | An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header. | [email protected] | 9.1 | 1.79% | 2024-02-28 | 2025-04-28 |
| CVE-2024-25169 | An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request. | [email protected] | 9.8 | 1.05% | 2024-02-28 | 2025-03-28 |
| CVE-2020-19002 | Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632. | [email protected] | 6.1 | 0.43% | 2021-08-27 | 2024-11-21 |
| CVE-2018-16632 | Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/. | [email protected] | 4.8 | 0.24% | 2018-12-28 | 2024-11-21 |