Orion's vulnerability footprint is concentrated in a small set of products including its core application server and related e-commerce extensions, where the durable signal centers on web-application input handling and request validation weaknesses such as cross-site request forgery and improper input validation. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Orion over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-46856HIGH Cross-Site Request Forgery (CSRF) vulnerability in ORION Woocommerce Products Designer plugin <= 4.3.3 versions. | May 25, 2023 | 8.8 | 27 | NO | NO |
CVE-2009-4493MEDIUM Orion Application Server 2.0.7 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly exe | Jan 13, 2010 | 5.0 | 26 | NO | YES |
CVE-2018-20999HIGH An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results. | Aug 26, 2019 | 7.5 | 23 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Orion.
Media articles that mention a CVE ID that affects a product developed by Orion — matched by CVE ID, not by vendor name.