[MEDIUM] Sulu checks fix permissions for subentities endpoints

PKSA-s8fv-tzzv-5y3k CVE-2026-34372 GHSA-6h7h-m7p5-hjqp

Affected version: >=3.0.0,<3.0.5|>=1.0.0,<2.6.22

Reported by:
GitHub

[MEDIUM] Injection of arbitrary HTML/JavaScript code through the media download URL

PKSA-g1w7-pdzy-w7y7 CVE-2024-47617 GHSA-6784-9c82-vr85

Affected version: >=2.0.0,<=2.5.20|>=2.6.0,<=2.6.4

Reported by:
GitHub

[MEDIUM] Cross-site Scripting via uploaded SVG

PKSA-mxjr-c7nk-459v CVE-2024-47618 GHSA-255w-87rh-rg44

Affected version: >=2.6.0-RC1,<2.6.5|>=2.0.0-RC1,<2.5.21

Reported by:
GitHub

[MEDIUM] Sulu grants access to pages regardless of role permissions

PKSA-ykzr-rw85-c27h CVE-2024-27915 GHSA-jr83-m233-gg6p

Affected version: >=2.5.0-alpha1,<2.5.13|>=2.2.0,<2.4.17

Reported by:
GitHub

[LOW] Sulu HTML Injection via Autocomplete Suggestion

PKSA-1zxy-qsnv-h3z4 CVE-2024-24807 GHSA-gfrh-gwqc-63cv

Affected version: >=2.5.0,<2.5.12|>=2.0.0,<2.4.16

Reported by:
GitHub

[HIGH] Privilege escalation in the Sulu Admin panel

PKSA-drhk-rjxy-c79p CVE-2021-43835 GHSA-84px-q68r-2fc9

Affected version: =2.4.0-RC1|>=2.3.0,<=2.3.7|>=2.0.0,<=2.2.17

Reported by:
GitHub

[HIGH] PHP file inclusion in the Sulu admin panel

PKSA-vy6d-prcg-w42z CVE-2021-43836 GHSA-vx6j-pjrh-vgjh

Affected version: =2.4.0-RC1|>=2.3.0,<2.3.8|>=2.0.0,<2.2.18|<1.6.44

Reported by:
GitHub