ghost

ghost vulnerable to unauthorized newsletter modification via improper access controls

Path Traversal in Ghost

Ghost vulnerable to information disclosure of private API fields

Ghost has incomplete CSRF protections around OTC use

Server-side request forgery in Ghost CMS

Ghost vulnerable to XSS via malicious Portal preview links

Ghost has a SQL injection in Content API

Arbitrary file upload in Ghost

Ghost has Staff 2FA bypass

DOM XSS in Theme Preview

Ghost has possible Cross-site Scripting issue

Ghost vulnerable to arbitrary file read via symlinks in content import

Ghost has Staff Token permission bypass

Ghost Vulnerable to Remote Code Execution via Malicious Themes

Arbitrary file upload in Ghost

Cross-site Scripting in Ghost

Ghost has SQL Injection in Members Activity Feed

Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark

Ghost has SSRF via External Media Inliner

Privilege escalation: all users can access Admin-level API keys

Ghost allows CSV Injection during member CSV export

Malicious code in gatsby-plugin-ghost-manifest (npm)

Malicious code in ghosts3c (npm)

Malicious code in gunpowder-ghost (npm)

Malicious code in ghost-module (npm)