CVE-2021-33926

An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet.

• CWE-918
• CWE-918

• https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdfExploit, Third Party Advisory
• https://plone.org/security/hotfix/20210518Release Notes
• https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-urlVendor Advisory
• https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdfExploit, Third Party Advisory
• https://plone.org/security/hotfix/20210518Release Notes
• https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-urlVendor Advisory

Published

Feb 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33912libspf2 before 1.2.11 has a four-byte heap-based buffer over…9.8
• CVE-2021-33913libspf2 before 1.2.11 has a heap-based buffer overflow that …9.8
• CVE-2021-3392A use-after-free flaw was found in the MegaRAID emulator of …3.2
• CVE-2021-33923Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0…5.5
• CVE-2021-33924Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 a…9.8
• CVE-2021-33925SQL Injection vulnerability in nitinparashar30 cms-corephp t…9.8
• CVE-2021-33928Buffer overflow vulnerability in function pool_installable i…7.5
• CVE-2021-33929Buffer overflow vulnerability in function pool_disabled_solv…7.5
• CVE-2021-3393An information leak was discovered in postgresql in versions…4.3
• CVE-2021-33930Buffer overflow vulnerability in function pool_installable_w…7.5
• CVE-2021-33938Buffer overflow vulnerability in function prune_to_recommend…7.5
• CVE-2021-3394Millennium Millewin (also known as "Cartella clinica") 13.39…8.8