Threat database

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.

A critical code injection vulnerability (CVE-2026-25776) exists in Six Apart Ltd. 's Movable Type version 9.1.0 and earlier. This flaw allows an unauthenticated attacker to execute arbitrary Perl scripts on the affected system. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently documented. There are no known exploits in the wild at this time. Users of affected versions should monitor vendor advisories for updates and apply patches once available.

CVE-2026-33088 is an SQL Injection vulnerability in Six Apart Ltd. 's Movable Type product versions 9.1.0 and earlier. This flaw allows an attacker to execute arbitrary SQL statements due to improper neutralization of special elements in SQL commands. The vulnerability has a CVSS 3.0 score of 7.3, indicating high severity with potential impacts on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-24447 is a medium severity vulnerability in Six Apart Ltd. 's Movable Type (Software Edition) affecting versions 8.0.2 to 9.0.5. It involves improper neutralization of formula elements in CSV files generated by the product, allowing maliciously crafted data to embed executable code within CSV exports. When a user downloads and opens such a CSV file in spreadsheet software, the embedded code may execute, potentially compromising the user's environment. The vulnerability requires at least limited privileges to generate the malformed CSV and user interaction to open the file. End-of-life versions 7 and 8.

CVE-2026-23704 is a medium-severity vulnerability in Six Apart Ltd. 's Movable Type (Software Edition) versions 8.0.2 to 8.0.8, 8.8.0 to 8.8.1, and 9.

CVE-2026-22875 is a stored cross-site scripting (XSS) vulnerability affecting Six Apart Ltd. 's Movable Type (Software Edition) versions 8.0.2 to 8.0.8, 8.8.0 to 8.8.1, and 9.

CVE-2026-21393 is a stored cross-site scripting (XSS) vulnerability affecting Six Apart Ltd. 's Movable Type (Software Edition) versions 8.0.2 to 8.0.8, 8.8.0 to 8.8.1, and 9.

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page.

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.

URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.

Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.