A CMS called Plone

Plone is a content management system using Zope application server. Just like any other popular application, it is prone to hacker attack. There is lesser exploits compared to PHP based CMS,

Example of pre Plone 3.1 security issue is the
Cross Site Request Forging (CSRF) security vulnerability where CSRF attacks work against people with a valid session on a Plone site: an attacker can — by tricking them (or their browser) to make an HTTP request to the site — use their active session and change security sensitive settings such as the users email address.

Following are general precautions on installation of CMS, refer to http://tboxmy.blogspot.com/2008/08/cms-called-joomla.html
Additional precautions you can take:

1. Keep Python updated.
   

Examples of vulnerability:
Password reset vulnerability, Plone tools did not have proper security checks for its password reset method, allowing anonymous users to reset any users password through the web. (affects pre 2.5)
plone-group-spoofing, Plone could allow a remote attacker to spoof certain information, caused by an unspecified vulnerability in member registration. If anonymous users can register as a member, a remote attacker could exploit this vulnerability and falsely register as a group. (Affects 2.5.1)
Plone CMS cookie places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network. (Affect pre 2.5)