All packages
Apache Roller vulnerabilities
3 known CVE vulnerabilities in Apache Roller, translated and rated.
- CVE-2015-0249High
The weblog page template in Apache Roller versions 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).
- CVE-2014-0030Critical
The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
- CVE-2023-37581Medium
All versions of Apache Roller have insufficient input validation and sanitation in the category name, website about, and file upload features, allowing an authenticated user to perform an XSS attack.