Search
Find a vulnerability
Search criteria
72 vulnerabilities by Six Apart Ltd.
CVE-2026-44392 (GCVE-0-2026-44392)
Vulnerability from nvd – Published: 2026-05-20 05:28 – Updated: 2026-05-20 13:04
VLAI
Summary
Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing authorization
Assigner
References
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type |
Affected:
9.1.1 and earlier
|
|
| Six Apart Ltd. | Movable Type |
Affected:
9.0.7 and earlier
|
|
| Six Apart Ltd. | Movable Type |
Affected:
8.8.3 and earlier
|
|
| Six Apart Ltd. | Movable Type |
Affected:
8.0.10 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced |
Affected:
9.1.1 and earlie
|
|
| Six Apart Ltd. | Movable Type Advanced |
Affected:
9.0.7 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced |
Affected:
8.8.3 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced |
Affected:
8.0.10 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium |
Affected:
9.1.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium |
Affected:
9.0.7 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium |
Affected:
2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) |
Affected:
9.1.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) |
Affected:
9.0.7 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) |
Affected:
2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44392",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T13:03:54.098462Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T13:04:04.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.1 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.7 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.3 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.10 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.1 and earlie"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.7 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.3 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.10 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.1 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.7 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.1 and earlier"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.7 and earlier"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T05:28:14.892Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/05/mt-908-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/05/20-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN66473735/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-44392",
"datePublished": "2026-05-20T05:28:14.892Z",
"dateReserved": "2026-05-18T05:54:22.563Z",
"dateUpdated": "2026-05-20T13:04:04.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33088 (GCVE-0-2026-33088)
Vulnerability from nvd – Published: 2026-04-08 08:51 – Updated: 2026-04-08 13:31
VLAI
Summary
Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL Injection')
Assigner
References
Impacted products
21 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33088",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T13:31:00.450725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T13:31:08.213Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.2 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.9 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.2 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.9 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type Premium (MT8-based)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "5.1 to 5.18"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"status": "affected",
"version": "5.2.1 to 5.2.13"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.0.1 to 6.8.8"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.4207 to r.5510"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.4"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.0 to 1.68"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper neutralization of special elements used in an SQL command (\u0027SQL Injection\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T08:51:45.916Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/04/mt-907-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/04/08-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN66473735/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-33088",
"datePublished": "2026-04-08T08:51:45.916Z",
"dateReserved": "2026-03-26T01:06:13.982Z",
"dateUpdated": "2026-04-08T13:31:08.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25776 (GCVE-0-2026-25776)
Vulnerability from nvd – Published: 2026-04-08 08:52 – Updated: 2026-04-08 13:22
VLAI
Summary
Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Code injection
Assigner
References
Impacted products
21 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T13:21:57.431441Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T13:22:04.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.2 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.9 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.2 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.9 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type Premium (MT8-based)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "5.1 to 5.18"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"status": "affected",
"version": "5.2.1 to 5.2.13"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.0.1 to 6.8.8"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.4207 to r.5510"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.4"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.0 to 1.68"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code injection",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T08:52:15.469Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/04/mt-907-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/04/08-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN66473735/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-25776",
"datePublished": "2026-04-08T08:52:15.469Z",
"dateReserved": "2026-03-26T01:06:12.957Z",
"dateUpdated": "2026-04-08T13:22:04.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-24447 (GCVE-0-2026-24447)
Vulnerability from nvd – Published: 2026-02-04 07:04 – Updated: 2026-02-04 15:55
VLAI
Summary
If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1236 - Improper neutralization of formula elements in a CSV file
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 8.8.1 (8 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 2.12 (MTP 2 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T15:55:19.585103Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T15:55:26.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "8.8.1 (8 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "2.12 (MTP 2 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper neutralization of formula elements in a CSV file",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T07:04:04.422Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/02/mt-906-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN45405689/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-24447",
"datePublished": "2026-02-04T07:04:04.422Z",
"dateReserved": "2026-01-29T02:02:27.800Z",
"dateUpdated": "2026-02-04T15:55:26.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23704 (GCVE-0-2026-23704)
Vulnerability from nvd – Published: 2026-02-04 07:03 – Updated: 2026-02-04 16:07
VLAI
Summary
A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-434 - Unrestricted upload of file with dangerous type
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 8.8.1 (8 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 2.12 (MTP 2 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T16:07:20.323679Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T16:07:28.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "8.8.1 (8 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "2.12 (MTP 2 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator\u0027s browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted upload of file with dangerous type",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T07:03:37.889Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/02/mt-906-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN45405689/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-23704",
"datePublished": "2026-02-04T07:03:37.889Z",
"dateReserved": "2026-01-29T02:02:31.425Z",
"dateUpdated": "2026-02-04T16:07:28.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22875 (GCVE-0-2026-22875)
Vulnerability from nvd – Published: 2026-02-04 07:03 – Updated: 2026-02-04 16:08
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 8.8.1 (8 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 2.12 (MTP 2 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T16:07:52.134565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T16:08:00.768Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "8.8.1 (8 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "2.12 (MTP 2 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user\u0027s web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T07:03:01.475Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/02/mt-906-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN45405689/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-22875",
"datePublished": "2026-02-04T07:03:01.475Z",
"dateReserved": "2026-01-29T02:02:30.407Z",
"dateUpdated": "2026-02-04T16:08:00.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21393 (GCVE-0-2026-21393)
Vulnerability from nvd – Published: 2026-02-04 07:02 – Updated: 2026-02-04 16:08
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 8.8.1 (8 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 2.12 (MTP 2 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21393",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T16:08:19.248184Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T16:08:26.340Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "8.8.1 (8 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "2.12 (MTP 2 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user\u0027s web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T07:02:50.465Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/02/mt-906-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN45405689/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-21393",
"datePublished": "2026-02-04T07:02:50.465Z",
"dateReserved": "2026-01-29T02:02:32.381Z",
"dateUpdated": "2026-02-04T16:08:26.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-62499 (GCVE-0-2025-62499)
Vulnerability from nvd – Published: 2025-10-23 04:10 – Updated: 2025-10-23 15:13
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
8.4.0 to 8.4.3 (8.4 series)
Affected: 8.0.0 to 8.0.7 (8.0 series) Affected: 7 r.5509 and earlier (7 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
8.4.0 to 8.4.3 (8.4 series)
Affected: 8.0.0 to 8.0.7 (8.0 series) Affected: 7 r.5509 and earlier (7 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
2.10 and earlier (2 series)
Affected: 1.67 and earlier (1 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
2.10 and earlier (2 series)
Affected: 1.67 and earlier (1 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
8.7.0 (8 series)
Affected: 7 r.5509 (7 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
2.10 (2 series)
Affected: 1.67 (1 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62499",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-23T15:13:06.261383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T15:13:25.011Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.3 (8.4 series)"
},
{
"status": "affected",
"version": "8.0.0 to 8.0.7 (8.0 series)"
},
{
"status": "affected",
"version": "7 r.5509 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.3 (8.4 series)"
},
{
"status": "affected",
"version": "8.0.0 to 8.0.7 (8.0 series)"
},
{
"status": "affected",
"version": "7 r.5509 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 and earlier (2 series)"
},
{
"status": "affected",
"version": "1.67 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 and earlier (2 series)"
},
{
"status": "affected",
"version": "1.67 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.7.0 (8 series)"
},
{
"status": "affected",
"version": "7 r.5509 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 (2 series)"
},
{
"status": "affected",
"version": "1.67 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with \"ContentType Management\" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T04:10:41.403Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/10/mt-880-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html"
},
{
"url": "https://jvn.jp/en/jp/JVN24333679/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-62499",
"datePublished": "2025-10-23T04:10:41.403Z",
"dateReserved": "2025-10-16T00:31:59.185Z",
"dateUpdated": "2025-10-23T15:13:25.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-54856 (GCVE-0-2025-54856)
Vulnerability from nvd – Published: 2025-10-23 04:10 – Updated: 2025-10-23 15:18
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
8.4.0 to 8.4.3 (8.4 series)
Affected: 8.0.0 to 8.0.7 (8.0 series) Affected: 7 r.5509 and earlier (7 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
8.4.0 to 8.4.3 (8.4 series)
Affected: 8.0.0 to 8.0.7 (8.0 series) Affected: 7 r.5509 and earlier (7 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
2.10 and earlier (2 series)
Affected: 1.67 and earlier (1 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
2.10 and earlier (2 series)
Affected: 1.67 and earlier (1 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
8.7.0 (8 series)
Affected: 7 r.5509 (7 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
2.10 (2 series)
Affected: 1.67 (1 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-54856",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-23T15:15:01.685901Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T15:18:25.113Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.3 (8.4 series)"
},
{
"status": "affected",
"version": "8.0.0 to 8.0.7 (8.0 series)"
},
{
"status": "affected",
"version": "7 r.5509 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.3 (8.4 series)"
},
{
"status": "affected",
"version": "8.0.0 to 8.0.7 (8.0 series)"
},
{
"status": "affected",
"version": "7 r.5509 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 and earlier (2 series)"
},
{
"status": "affected",
"version": "1.67 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 and earlier (2 series)"
},
{
"status": "affected",
"version": "1.67 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.7.0 (8 series)"
},
{
"status": "affected",
"version": "7 r.5509 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 (2 series)"
},
{
"status": "affected",
"version": "1.67 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with \"ContentType Management\" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T04:10:30.545Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/10/mt-880-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html"
},
{
"url": "https://jvn.jp/en/jp/JVN24333679/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-54856",
"datePublished": "2025-10-23T04:10:30.545Z",
"dateReserved": "2025-10-16T00:31:56.364Z",
"dateUpdated": "2025-10-23T15:18:25.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-55706 (GCVE-0-2025-55706)
Vulnerability from nvd – Published: 2025-08-20 04:23 – Updated: 2025-08-20 15:57
VLAI
Summary
URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - URL redirection to untrusted site ('Open Redirect')
Assigner
References
2 references
Impacted products
12 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55706",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-20T15:57:20.123486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T15:57:41.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.6.0 (8 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 (2 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "URL redirection to untrusted site (\u0027Open Redirect\u0027) issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL redirection to untrusted site (\u0027Open Redirect\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T04:23:01.512Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/08/mt-843-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN76729865/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-55706",
"datePublished": "2025-08-20T04:23:01.512Z",
"dateReserved": "2025-08-14T05:29:33.614Z",
"dateUpdated": "2025-08-20T15:57:41.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-53522 (GCVE-0-2025-53522)
Vulnerability from nvd – Published: 2025-08-20 04:22 – Updated: 2025-08-20 16:00
VLAI
Summary
Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-348 - Use of less trusted source
Assigner
References
2 references
Impacted products
12 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53522",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-20T16:00:10.875489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T16:00:35.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.6.0 (8 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 (2 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-348",
"description": "Use of less trusted source",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T04:22:51.144Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/08/mt-843-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN76729865/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-53522",
"datePublished": "2025-08-20T04:22:51.144Z",
"dateReserved": "2025-08-14T05:29:32.466Z",
"dateUpdated": "2025-08-20T16:00:35.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-25054 (GCVE-0-2025-25054)
Vulnerability from nvd – Published: 2025-02-19 05:52 – Updated: 2025-02-19 14:53
VLAI
Summary
Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Cloud Edition (8.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium Cloud Edition (2.x series) |
Affected:
2.06 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-25054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-19T14:52:52.856903Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T14:53:01.685Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Premium (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Cloud Edition (8.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Premium Cloud Edition (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T05:52:09.401Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.movabletype.org/news/2025/02/mt-842-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN48742353/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-25054",
"datePublished": "2025-02-19T05:52:09.401Z",
"dateReserved": "2025-02-03T00:23:31.179Z",
"dateUpdated": "2025-02-19T14:53:01.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-24841 (GCVE-0-2025-24841)
Vulnerability from nvd – Published: 2025-02-19 05:52 – Updated: 2025-02-19 14:52
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Cloud Edition (8.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium Cloud Edition (2.x series) |
Affected:
2.06 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24841",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-19T14:52:35.812470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T14:52:41.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Premium (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Cloud Edition (8.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Premium Cloud Edition (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user\u0027s web browser."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T05:52:15.125Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.movabletype.org/news/2025/02/mt-842-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN48742353/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-24841",
"datePublished": "2025-02-19T05:52:15.125Z",
"dateReserved": "2025-02-03T00:23:32.055Z",
"dateUpdated": "2025-02-19T14:52:41.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22888 (GCVE-0-2025-22888)
Vulnerability from nvd – Published: 2025-02-19 05:52 – Updated: 2025-02-19 14:54
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user's web browser.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Cloud Edition (8.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium Cloud Edition (2.x series) |
Affected:
2.06 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22888",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-19T14:54:09.952776Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T14:54:27.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Premium (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Cloud Edition (8.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Premium Cloud Edition (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user\u0027s web browser."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T05:52:02.918Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.movabletype.org/news/2025/02/mt-842-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN48742353/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-22888",
"datePublished": "2025-02-19T05:52:02.918Z",
"dateReserved": "2025-02-03T00:23:33.090Z",
"dateUpdated": "2025-02-19T14:54:27.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-45746 (GCVE-0-2023-45746)
Vulnerability from nvd – Published: 2023-10-30 04:57 – Updated: 2024-10-29 18:23
VLAI
Summary
Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type 7 (Movable Type 7 Series) |
Affected:
r.5405 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced 7 (Movable Type 7 Series) |
Affected:
r.5405 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium |
Affected:
1.58 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium Advanced |
Affected:
1.58 and earlier
|
|
| Six Apart Ltd. | Movable Type Cloud Edition (Version 7) |
Affected:
r.5405 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium Cloud Edition |
Affected:
1.58 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:29:32.220Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://movabletype.org/news/2023/10/mt-79020-released.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN39139884/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-45746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-06T19:30:04.872226Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T18:23:10.383Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type 7 (Movable Type 7 Series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "r.5405 and earlier"
}
]
},
{
"product": "Movable Type Advanced 7 (Movable Type 7 Series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "r.5405 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.58 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.58 and earlier"
}
]
},
{
"product": "Movable Type Cloud Edition (Version 7)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "r.5405 and earlier"
}
]
},
{
"product": "Movable Type Premium Cloud Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.58 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-30T04:57:43.561Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2023/10/mt-79020-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN39139884/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-45746",
"datePublished": "2023-10-30T04:57:43.561Z",
"dateReserved": "2023-10-12T05:42:52.133Z",
"dateUpdated": "2024-10-29T18:23:10.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-44392 (GCVE-0-2026-44392)
Vulnerability from cvelistv5 – Published: 2026-05-20 05:28 – Updated: 2026-05-20 13:04
VLAI
Summary
Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing authorization
Assigner
References
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type |
Affected:
9.1.1 and earlier
|
|
| Six Apart Ltd. | Movable Type |
Affected:
9.0.7 and earlier
|
|
| Six Apart Ltd. | Movable Type |
Affected:
8.8.3 and earlier
|
|
| Six Apart Ltd. | Movable Type |
Affected:
8.0.10 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced |
Affected:
9.1.1 and earlie
|
|
| Six Apart Ltd. | Movable Type Advanced |
Affected:
9.0.7 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced |
Affected:
8.8.3 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced |
Affected:
8.0.10 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium |
Affected:
9.1.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium |
Affected:
9.0.7 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium |
Affected:
2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) |
Affected:
9.1.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) |
Affected:
9.0.7 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) |
Affected:
2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44392",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T13:03:54.098462Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T13:04:04.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.1 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.7 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.3 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.10 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.1 and earlie"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.7 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.3 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.10 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.1 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.7 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.1 and earlier"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.7 and earlier"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T05:28:14.892Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/05/mt-908-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/05/20-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN66473735/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-44392",
"datePublished": "2026-05-20T05:28:14.892Z",
"dateReserved": "2026-05-18T05:54:22.563Z",
"dateUpdated": "2026-05-20T13:04:04.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25776 (GCVE-0-2026-25776)
Vulnerability from cvelistv5 – Published: 2026-04-08 08:52 – Updated: 2026-04-08 13:22
VLAI
Summary
Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Code injection
Assigner
References
Impacted products
21 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T13:21:57.431441Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T13:22:04.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.2 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.9 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.2 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.9 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type Premium (MT8-based)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "5.1 to 5.18"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"status": "affected",
"version": "5.2.1 to 5.2.13"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.0.1 to 6.8.8"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.4207 to r.5510"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.4"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.0 to 1.68"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code injection",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T08:52:15.469Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/04/mt-907-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/04/08-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN66473735/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-25776",
"datePublished": "2026-04-08T08:52:15.469Z",
"dateReserved": "2026-03-26T01:06:12.957Z",
"dateUpdated": "2026-04-08T13:22:04.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33088 (GCVE-0-2026-33088)
Vulnerability from cvelistv5 – Published: 2026-04-08 08:51 – Updated: 2026-04-08 13:31
VLAI
Summary
Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL Injection')
Assigner
References
Impacted products
21 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33088",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T13:31:00.450725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T13:31:08.213Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.2 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.9 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.8.2 and earlier"
}
]
},
{
"product": "Movable Type Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.9 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.1.0 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.6 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type Premium (MT8-based)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.14 and earlier"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "5.1 to 5.18"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"status": "affected",
"version": "5.2.1 to 5.2.13"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.0.1 to 6.8.8"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.4207 to r.5510"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.4"
}
]
},
{
"product": "Movable Type",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.0 to 1.68"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper neutralization of special elements used in an SQL command (\u0027SQL Injection\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T08:51:45.916Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/04/mt-907-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/04/08-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN66473735/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-33088",
"datePublished": "2026-04-08T08:51:45.916Z",
"dateReserved": "2026-03-26T01:06:13.982Z",
"dateUpdated": "2026-04-08T13:31:08.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-24447 (GCVE-0-2026-24447)
Vulnerability from cvelistv5 – Published: 2026-02-04 07:04 – Updated: 2026-02-04 15:55
VLAI
Summary
If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1236 - Improper neutralization of formula elements in a CSV file
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 8.8.1 (8 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 2.12 (MTP 2 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T15:55:19.585103Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T15:55:26.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "8.8.1 (8 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "2.12 (MTP 2 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper neutralization of formula elements in a CSV file",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T07:04:04.422Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/02/mt-906-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN45405689/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-24447",
"datePublished": "2026-02-04T07:04:04.422Z",
"dateReserved": "2026-01-29T02:02:27.800Z",
"dateUpdated": "2026-02-04T15:55:26.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23704 (GCVE-0-2026-23704)
Vulnerability from cvelistv5 – Published: 2026-02-04 07:03 – Updated: 2026-02-04 16:07
VLAI
Summary
A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-434 - Unrestricted upload of file with dangerous type
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 8.8.1 (8 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 2.12 (MTP 2 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T16:07:20.323679Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T16:07:28.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "8.8.1 (8 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "2.12 (MTP 2 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator\u0027s browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted upload of file with dangerous type",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T07:03:37.889Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/02/mt-906-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN45405689/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-23704",
"datePublished": "2026-02-04T07:03:37.889Z",
"dateReserved": "2026-01-29T02:02:31.425Z",
"dateUpdated": "2026-02-04T16:07:28.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22875 (GCVE-0-2026-22875)
Vulnerability from cvelistv5 – Published: 2026-02-04 07:03 – Updated: 2026-02-04 16:08
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 8.8.1 (8 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 2.12 (MTP 2 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T16:07:52.134565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T16:08:00.768Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "8.8.1 (8 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "2.12 (MTP 2 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user\u0027s web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T07:03:01.475Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/02/mt-906-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN45405689/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-22875",
"datePublished": "2026-02-04T07:03:01.475Z",
"dateReserved": "2026-01-29T02:02:30.407Z",
"dateUpdated": "2026-02-04T16:08:00.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21393 (GCVE-0-2026-21393)
Vulnerability from cvelistv5 – Published: 2026-02-04 07:02 – Updated: 2026-02-04 16:08
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
9.0.4 (MTP 9.0 series)
Affected: 2.13 and earlier (MTP 2 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 8.8.1 (8 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
9.0.5 (9 series)
Affected: 2.12 (MTP 2 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21393",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T16:08:19.248184Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T16:08:26.340Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 to 9.0.5 (9.0 series)"
},
{
"status": "affected",
"version": "8.8.0 to 8.8.1 (8.8 series)"
},
{
"status": "affected",
"version": "8.0.2 to 8.0.8 (8.0 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.4 (MTP 9.0 series)"
},
{
"status": "affected",
"version": "2.13 and earlier (MTP 2 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "8.8.1 (8 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "9.0.5 (9 series)"
},
{
"status": "affected",
"version": "2.12 (MTP 2 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user\u0027s web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T07:02:50.465Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2026/02/mt-906-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
},
{
"url": "https://jvn.jp/en/jp/JVN45405689/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-21393",
"datePublished": "2026-02-04T07:02:50.465Z",
"dateReserved": "2026-01-29T02:02:32.381Z",
"dateUpdated": "2026-02-04T16:08:26.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-62499 (GCVE-0-2025-62499)
Vulnerability from cvelistv5 – Published: 2025-10-23 04:10 – Updated: 2025-10-23 15:13
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
8.4.0 to 8.4.3 (8.4 series)
Affected: 8.0.0 to 8.0.7 (8.0 series) Affected: 7 r.5509 and earlier (7 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
8.4.0 to 8.4.3 (8.4 series)
Affected: 8.0.0 to 8.0.7 (8.0 series) Affected: 7 r.5509 and earlier (7 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
2.10 and earlier (2 series)
Affected: 1.67 and earlier (1 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
2.10 and earlier (2 series)
Affected: 1.67 and earlier (1 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
8.7.0 (8 series)
Affected: 7 r.5509 (7 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
2.10 (2 series)
Affected: 1.67 (1 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62499",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-23T15:13:06.261383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T15:13:25.011Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.3 (8.4 series)"
},
{
"status": "affected",
"version": "8.0.0 to 8.0.7 (8.0 series)"
},
{
"status": "affected",
"version": "7 r.5509 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.3 (8.4 series)"
},
{
"status": "affected",
"version": "8.0.0 to 8.0.7 (8.0 series)"
},
{
"status": "affected",
"version": "7 r.5509 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 and earlier (2 series)"
},
{
"status": "affected",
"version": "1.67 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 and earlier (2 series)"
},
{
"status": "affected",
"version": "1.67 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.7.0 (8 series)"
},
{
"status": "affected",
"version": "7 r.5509 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 (2 series)"
},
{
"status": "affected",
"version": "1.67 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with \"ContentType Management\" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T04:10:41.403Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/10/mt-880-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html"
},
{
"url": "https://jvn.jp/en/jp/JVN24333679/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-62499",
"datePublished": "2025-10-23T04:10:41.403Z",
"dateReserved": "2025-10-16T00:31:59.185Z",
"dateUpdated": "2025-10-23T15:13:25.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-54856 (GCVE-0-2025-54856)
Vulnerability from cvelistv5 – Published: 2025-10-23 04:10 – Updated: 2025-10-23 15:18
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (Software Edition) |
Affected:
8.4.0 to 8.4.3 (8.4 series)
Affected: 8.0.0 to 8.0.7 (8.0 series) Affected: 7 r.5509 and earlier (7 series) |
|
| Six Apart Ltd. | Movable Type Advanced (Software Edition) |
Affected:
8.4.0 to 8.4.3 (8.4 series)
Affected: 8.0.0 to 8.0.7 (8.0 series) Affected: 7 r.5509 and earlier (7 series) |
|
| Six Apart Ltd. | Movable Type Premium (Software Edition) |
Affected:
2.10 and earlier (2 series)
Affected: 1.67 and earlier (1 series) |
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (Software Edition) |
Affected:
2.10 and earlier (2 series)
Affected: 1.67 and earlier (1 series) |
|
| Six Apart Ltd. | Movable Type (Cloud Edition) |
Affected:
8.7.0 (8 series)
Affected: 7 r.5509 (7 series) |
|
| Six Apart Ltd. | Movable Type Premium (Cloud Edition) |
Affected:
2.10 (2 series)
Affected: 1.67 (1 series) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-54856",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-23T15:15:01.685901Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T15:18:25.113Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.3 (8.4 series)"
},
{
"status": "affected",
"version": "8.0.0 to 8.0.7 (8.0 series)"
},
{
"status": "affected",
"version": "7 r.5509 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.0 to 8.4.3 (8.4 series)"
},
{
"status": "affected",
"version": "8.0.0 to 8.0.7 (8.0 series)"
},
{
"status": "affected",
"version": "7 r.5509 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 and earlier (2 series)"
},
{
"status": "affected",
"version": "1.67 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 and earlier (2 series)"
},
{
"status": "affected",
"version": "1.67 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.7.0 (8 series)"
},
{
"status": "affected",
"version": "7 r.5509 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.10 (2 series)"
},
{
"status": "affected",
"version": "1.67 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with \"ContentType Management\" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T04:10:30.545Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/10/mt-880-released.html"
},
{
"url": "https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html"
},
{
"url": "https://jvn.jp/en/jp/JVN24333679/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-54856",
"datePublished": "2025-10-23T04:10:30.545Z",
"dateReserved": "2025-10-16T00:31:56.364Z",
"dateUpdated": "2025-10-23T15:18:25.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-55706 (GCVE-0-2025-55706)
Vulnerability from cvelistv5 – Published: 2025-08-20 04:23 – Updated: 2025-08-20 15:57
VLAI
Summary
URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - URL redirection to untrusted site ('Open Redirect')
Assigner
References
2 references
Impacted products
12 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55706",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-20T15:57:20.123486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T15:57:41.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.6.0 (8 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 (2 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "URL redirection to untrusted site (\u0027Open Redirect\u0027) issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL redirection to untrusted site (\u0027Open Redirect\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T04:23:01.512Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/08/mt-843-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN76729865/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-55706",
"datePublished": "2025-08-20T04:23:01.512Z",
"dateReserved": "2025-08-14T05:29:33.614Z",
"dateUpdated": "2025-08-20T15:57:41.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-53522 (GCVE-0-2025-53522)
Vulnerability from cvelistv5 – Published: 2025-08-20 04:22 – Updated: 2025-08-20 16:00
VLAI
Summary
Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-348 - Use of less trusted source
Assigner
References
2 references
Impacted products
12 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53522",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-20T16:00:10.875489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T16:00:35.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.6.0 (8 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 (2 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-348",
"description": "Use of less trusted source",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T04:22:51.144Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/08/mt-843-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN76729865/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-53522",
"datePublished": "2025-08-20T04:22:51.144Z",
"dateReserved": "2025-08-14T05:29:32.466Z",
"dateUpdated": "2025-08-20T16:00:35.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-24841 (GCVE-0-2025-24841)
Vulnerability from cvelistv5 – Published: 2025-02-19 05:52 – Updated: 2025-02-19 14:52
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Cloud Edition (8.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium Cloud Edition (2.x series) |
Affected:
2.06 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24841",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-19T14:52:35.812470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T14:52:41.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Premium (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Cloud Edition (8.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Premium Cloud Edition (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user\u0027s web browser."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T05:52:15.125Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.movabletype.org/news/2025/02/mt-842-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN48742353/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-24841",
"datePublished": "2025-02-19T05:52:15.125Z",
"dateReserved": "2025-02-03T00:23:32.055Z",
"dateUpdated": "2025-02-19T14:52:41.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-25054 (GCVE-0-2025-25054)
Vulnerability from cvelistv5 – Published: 2025-02-19 05:52 – Updated: 2025-02-19 14:53
VLAI
Summary
Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Cloud Edition (8.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium Cloud Edition (2.x series) |
Affected:
2.06 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-25054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-19T14:52:52.856903Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T14:53:01.685Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Premium (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Cloud Edition (8.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Premium Cloud Edition (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T05:52:09.401Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.movabletype.org/news/2025/02/mt-842-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN48742353/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-25054",
"datePublished": "2025-02-19T05:52:09.401Z",
"dateReserved": "2025-02-03T00:23:31.179Z",
"dateUpdated": "2025-02-19T14:53:01.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22888 (GCVE-0-2025-22888)
Vulnerability from cvelistv5 – Published: 2025-02-19 05:52 – Updated: 2025-02-19 14:54
VLAI
Summary
Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user's web browser.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.4.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced (8.0.x series) |
Affected:
8.0.5 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium (Advanced Edition) (2.x series) |
Affected:
2.06 and earlier
|
|
| Six Apart Ltd. | Movable Type Cloud Edition (8.x series) |
Affected:
8.4.1 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium Cloud Edition (2.x series) |
Affected:
2.06 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22888",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-19T14:54:09.952776Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T14:54:27.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.4.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Advanced (8.0.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.5 and earlier"
}
]
},
{
"product": "Movable Type Premium (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
},
{
"product": "Movable Type Cloud Edition (8.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.4.1 and earlier"
}
]
},
{
"product": "Movable Type Premium Cloud Edition (2.x series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.06 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user\u0027s web browser."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T05:52:02.918Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.movabletype.org/news/2025/02/mt-842-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN48742353/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-22888",
"datePublished": "2025-02-19T05:52:02.918Z",
"dateReserved": "2025-02-03T00:23:33.090Z",
"dateUpdated": "2025-02-19T14:54:27.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-45746 (GCVE-0-2023-45746)
Vulnerability from cvelistv5 – Published: 2023-10-30 04:57 – Updated: 2024-10-29 18:23
VLAI
Summary
Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Six Apart Ltd. | Movable Type 7 (Movable Type 7 Series) |
Affected:
r.5405 and earlier
|
|
| Six Apart Ltd. | Movable Type Advanced 7 (Movable Type 7 Series) |
Affected:
r.5405 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium |
Affected:
1.58 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium Advanced |
Affected:
1.58 and earlier
|
|
| Six Apart Ltd. | Movable Type Cloud Edition (Version 7) |
Affected:
r.5405 and earlier
|
|
| Six Apart Ltd. | Movable Type Premium Cloud Edition |
Affected:
1.58 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:29:32.220Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://movabletype.org/news/2023/10/mt-79020-released.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN39139884/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-45746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-06T19:30:04.872226Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T18:23:10.383Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type 7 (Movable Type 7 Series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "r.5405 and earlier"
}
]
},
{
"product": "Movable Type Advanced 7 (Movable Type 7 Series)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "r.5405 and earlier"
}
]
},
{
"product": "Movable Type Premium",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.58 and earlier"
}
]
},
{
"product": "Movable Type Premium Advanced",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.58 and earlier"
}
]
},
{
"product": "Movable Type Cloud Edition (Version 7)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "r.5405 and earlier"
}
]
},
{
"product": "Movable Type Premium Cloud Edition",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.58 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-30T04:57:43.561Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2023/10/mt-79020-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN39139884/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-45746",
"datePublished": "2023-10-30T04:57:43.561Z",
"dateReserved": "2023-10-12T05:42:52.133Z",
"dateUpdated": "2024-10-29T18:23:10.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}