Threat Intelligence Database

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.

A critical code injection vulnerability (CVE-2026-25776) exists in Six Apart Ltd. 's Movable Type version 9.1.0 and earlier. This flaw allows an unauthenticated attacker to execute arbitrary Perl scripts on the affected system. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently documented. There are no known exploits in the wild at this time. Users of affected versions should monitor vendor advisories for updates and apply patches once available.

CVE-2026-33088 is an SQL Injection vulnerability in Six Apart Ltd. 's Movable Type product versions 9.1.0 and earlier. This flaw allows an attacker to execute arbitrary SQL statements due to improper neutralization of special elements in SQL commands. The vulnerability has a CVSS 3.0 score of 7.3, indicating high severity with potential impacts on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-24447 is a medium severity vulnerability in Six Apart Ltd. 's Movable Type (Software Edition) affecting versions 8.0.2 to 9.0.5. It involves improper neutralization of formula elements in CSV files generated by the product, allowing maliciously crafted data to embed executable code within CSV exports. When a user downloads and opens such a CSV file in spreadsheet software, the embedded code may execute, potentially compromising the user's environment. The vulnerability requires at least limited privileges to generate the malformed CSV and user interaction to open the file. End-of-life versions 7 and 8.

MediumVulnerabilityGermanyFranceNetherlands+2#cve#cve-2026-24447

CVE-2026-23704 is a medium-severity vulnerability in Six Apart Ltd. 's Movable Type (Software Edition) versions 8.0.2 to 8.0.8, 8.8.0 to 8.8.1, and 9.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2026-23704

CVE-2026-22875 is a stored cross-site scripting (XSS) vulnerability affecting Six Apart Ltd. 's Movable Type (Software Edition) versions 8.0.2 to 8.0.8, 8.8.0 to 8.8.1, and 9.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2026-22875

CVE-2026-21393 is a stored cross-site scripting (XSS) vulnerability affecting Six Apart Ltd. 's Movable Type (Software Edition) versions 8.0.2 to 8.0.8, 8.8.0 to 8.8.1, and 9.

MediumVulnerabilityGermanyFranceNetherlands+5#cve#cve-2026-21393

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page.

MediumVulnerabilityUnited KingdomGermanyFrance+4#cve#cve-2025-62499

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.

MediumVulnerabilityUnited KingdomGermanyFrance+3#cve#cve-2025-54856