PackagistPackage

craftcms/cms

132 known vulnerabilities (6 critical, 47 high, 51 medium, 5 low), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 132 · 6 critical, 47 high, 51 medium, 5 low

Registry: Packagist

Advisories 132

CVE-2026-79987High 8.7
Low-privilege RCE through element-search eager loading
Affected: from 5.8.0, fixed in 5.10.13.
CVE-2026-79991High 7.1
Authenticated SQL Injection via nested eager-loading criteria
Affected: from 5.0.0-RC1, fixed in 5.10.13.
CVE-2026-79990High 8.7
GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Affected: from 5.0.0-RC1, fixed in 5.10.11.
CVE-2026-79989High 8.7
Arbitrary user password reset leading to administrator account takeover
Affected: from 5.0.0-RC1, fixed in 5.10.8; from 5.0.0-RC1, fixed in 5.10.8.
CVE-2026-79988High 8.7
Authenticated RCE through Twig sandbox escape
Affected: from 4.0.0-RC1, fixed in 4.18.3; from 5.0.0-RC1, fixed in 5.10.7.
CVE-2026-78416High 8.7
Authenticated RCE via `condition.config` JSON cleanse bypass
Affected: from 4.0.0-RC1, fixed in 4.18.2; from 5.0.0-RC1, fixed in 5.10.6.
CVE-2026-72787Medium 5.1
Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name
Affected: from 5.0.0-RC1, fixed in 5.10.8.
CVE-2026-72786High 7.1
Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset
Affected: from 5.0.0-RC1, fixed in 5.10.8.
CVE-2026-72785Critical 9.3
Craft CMS before 5.10.6 Authorization Bypass via structures/move-element
Affected: from 5.0.0-RC1, fixed in 5.10.6.
CVE-2026-72783Medium 6.9
Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained
Affected: from 5.0.0-RC1, fixed in 5.10.6; from 4.0.0-RC1, fixed in 4.18.2.
CVE-2026-72782High 7.1
Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak
Affected: from 5.0.0-RC1, fixed in 5.10.6; from 4.0.0-RC1, fixed in 4.18.2.
CVE-2026-72781High 8.7
Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
Affected: from 5.0.0-RC1, fixed in 5.10.7; from 4.0.0-RC1, fixed in 4.18.3.
CVE-2026-72780High 7.1
Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey
Affected: from 5.0.0-RC1, fixed in 5.10.5.
CVE-2026-72779High 8.7
Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject
Affected: from 5.0.0-RC1, fixed in 5.10.6; from 4.0.0-RC1, fixed in 4.18.2.
CVE-2026-72778High 8.7
Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config
Affected: from 5.0.0-RC1, fixed in 5.10.6; from 4.0.0-RC1, fixed in 4.18.2.

Show all 132 advisoriesShow fewer advisories

CVE-2026-14794Medium 5.3
Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization
Affected: from 4.0.0-RC1, fixed in 4.18.1; from 5.0.0-RC1, fixed in 5.10.3.
CVE-2026-14793Medium 5.3
Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization
Affected: from 4.0.0-RC1, fixed in 4.18.1; from 5.0.0-RC1, fixed in 5.10.3.
CVE-2026-50282Medium 4.9
Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves
Affected: from 5.0.0-RC1, fixed in 5.9.21; from 4.0.0-RC1, fixed in 4.17.14.
CVE-2026-50281High 7.1
Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
Affected: from 5.7.0, fixed in 5.9.21.
CVE-2026-50280Medium 6.0
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
Affected: from 5.0.0-RC1, fixed in 5.9.21.
CVE-2026-50279High 7.6
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
Affected: from 5.0.0-RC1, fixed in 5.9.21.
CVE-2026-55794High 8.7
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
Affected: from 5.9.0, fixed in 5.10.0.
CVE-2026-55792Medium 6.0
Craft CMS: Sensitive File Disclosure / Server-Side File Read
Affected: from 4.0.0-RC1, fixed in 4.18.0; from 5.0.0-RC1, fixed in 5.10.0.
CVE-2026-55791Medium 6.9
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
Affected: from 5.0.0-RC1, fixed in 5.10; from 4.0.0-RC1, fixed in 4.18.
CVE-2026-55790High 7.4
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
Affected: from 5.0.0-RC1, fixed in 5.9.23; from 4.0.0-RC1, fixed in 4.17.16.
CVE-2026-50284High 7.1
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
Affected: from 5.0.0-RC1, fixed in 5.9.22; from 4.0.0-RC1, fixed in 4.17.15.
CVE-2026-50283Medium 5.3
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
Affected: from 5.0.0-RC1, fixed in 5.9.21; from 4.0.0-RC1, fixed in 4.17.14.
CVE-2026-55793Medium 5.9
Craft CMS: Stored XSS via Structure entry title in table view
Affected: from 5.0.0-RC1, fixed in 5.9.53.
CVE-2026-56394High 7.1
Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter
Affected: from 4.0.0-RC1, fixed in 4.17.7; from 5.0.0-RC1, fixed in 5.9.13.
CVE-2026-56393Medium 4.6
Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options
Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.
CVE-2026-56385Medium 5.3
Craft CMS - Authorization Bypass in assets/preview-file Endpoint
Affected: from 5.0.0-RC1, fixed in 5.9.14; from 4.0.0-RC1, fixed in 4.17.8.
CVE-2026-56384Medium 5.3
Craft CMS - Missing Authorization in assets/preview-thumb Endpoint
Affected: from 4.0.0-RC1, fixed in 4.17.8; from 5.0.0-RC1, fixed in 5.9.14.
CVE-2026-56383Medium 4.6
Craft CMS - Stored XSS in Table Field via Row Heading Column Type
Affected: from 4.5.0-beta.1, fixed in 4.16.19; from 5.0.0-RC1, fixed in 5.8.23.
CVE-2026-56382High 8.6
Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController
Affected: from 5.5.0, fixed in 5.9.14.
CVE-2026-56381Medium 4.6
Craft CMS - Stored XSS via User Group Name in User Permissions Page
Affected: from 5.0.0-RC1, fixed in 5.8.22.
CVE-2026-44011High 8.6
Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
Affected: from 4.0.0, fixed in 4.17.12; from 5.0.0, fixed in 5.9.18.
CVE-2026-44012High 7.1
Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
Affected: from 5.0.0-RC1, fixed in 5.9.18.
CVE-2026-44010High 7.1
Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
Affected: from 5.0.0, fixed in 5.9.18; from 4.0.0, fixed in 4.17.12.
CVE-2026-41130Medium 5.5
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
Affected: from 5.0.0-RC1, fixed in 5.9.15; from 4.0.0-RC1, fixed in 4.17.9.
CVE-2026-41129Medium 5.5
Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations
Affected: from 5.0.0-RC1, fixed in 5.9.15; from 4.0.0-RC1, fixed in 4.17.9.
CVE-2026-41128Medium 5.3
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Affected: from 5.6.0, fixed in 5.9.15.
CVE-2026-33162Medium 4.9
Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions
Affected: from 5.3.0, fixed in 5.9.14.
CVE-2026-33161Low 1.3
Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users
Affected: from 5.0.0-RC1, fixed in 5.9.14; from 4.0.0-RC1, fixed in 4.17.8.
CVE-2026-33160Low 2.7
Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL
Affected: from 5.0.0-RC1, fixed in 5.9.14; from 4.0.0-RC1, fixed in 4.17.8.
CVE-2026-33159Medium 6.9
Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users
Affected: from 5.0.0-RC1, fixed in 5.9.14; from 4.0.0-RC1, fixed in 4.17.8.
CVE-2026-33158Medium 4.9
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
Affected: from 4.0.0-RC1, fixed in 4.17.8; from 5.0.0-RC1, fixed in 5.9.14.
CVE-2026-33157High 8.6
Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
Affected: from 5.6.0, fixed in 5.9.13.
CVE-2026-33051Medium 5.3
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
Affected: from 5.9.0-beta.1, fixed in 5.9.11.
CVE-2026-32267High 7.7
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
Affected: from 4.0.0-RC1, fixed in 4.17.6; from 5.0.0-RC1, fixed in 5.9.12.
CVE-2026-32264High 8.6
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Affected: from 4.0.0-RC1, fixed in 4.17.5; from 5.0.0-RC1, fixed in 5.9.11.
CVE-2026-32263High 8.6
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Affected: from 5.6.0, fixed in 5.9.11.
CVE-2026-32262Medium 5.3
Craft CMS has a Path Traversal Vulnerability in AssetsController
Affected: from 4.0.0-RC1, fixed in 4.17.5; from 5.0.0-RC1, fixed in 5.9.11.
CVE-2026-31859Medium 6.9
Craft has Reflective XSS via incomplete return URL sanitization
Affected: from 4.15.3, fixed in 4.17.3; from 5.7.5, fixed in 5.9.7.
CVE-2026-31858High 8.7
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
Affected: from 5.0.0-RC1, fixed in 5.9.9.
CVE-2026-31857High 8.1
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
Affected: from 5.0.0-RC1, fixed in 5.9.9; from 4.0.0-beta.1, fixed in 4.17.4.
CVE-2026-29113Low 2.3
Craft has a potential information disclosure vulnerability in preview tokens
Affected: from 4.0.0-RC1, fixed in 4.17.3; from 5.0.0-RC1, fixed in 5.9.7.
CVE-2026-29069Medium 6.9
Craft has an unauthenticated activation email trigger with potential user enumeration
Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.2; from 4.0.0-RC1, fixed in 4.17.0-beta.2.
CVE-2026-28784High 8.6
Craft is affected by potential authenticated Remote Code Execution via Twig SSTI
Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.
CVE-2026-28783Critical 9.4
Craft has a Twig Function Blocklist Bypass
Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.
CVE-2026-28782Medium 5.3
Craft has a Permission Bypass and IDOR in Duplicate Entry Action
Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.
CVE-2026-28781High 7.1
Craft Affected by Entries Authorship Spoofing via Mass Assignment
Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.
CVE-2026-28697Critical 9.4
Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates
Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.
CVE-2026-28696High 8.7
Craft affected by IDOR via GraphQL @parseRefs
Affected: from 4.0.0-RC1, fixed in 4.17.0-beta.1; from 5.0.0-RC1, fixed in 5.9.0-beta.1.
CVE-2026-28695High 7.5
Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Affected: from 5.8.7, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.
CVE-2026-27129Medium 5.7
Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
Affected: from 5.0.0-RC1, fixed in 5.8.23; from 3.5.0, fixed in 4.16.19.
CVE-2026-27128Medium 6.9
Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit
Affected: from 4.5.0-RC1, fixed in 4.16.19; from 5.0.0-RC1, fixed in 5.8.23.
CVE-2026-27127High 7.0
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Affected: from 5.0.0-RC1, fixed in 5.8.23; from 3.5.0, fixed in 4.16.19.
CVE-2026-27126Medium 5.9
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
Affected: from 4.5.0-RC1, fixed in 4.16.19; from 5.0.0-RC1, fixed in 5.8.23.
CVE-2026-25498High 8.6
Craft has a potential authenticated Remote Code Execution via malicious attached Behavior
Affected: from 5.0.0-RC1, fixed in 5.8.22; from 4.0.0-RC1, fixed in 4.16.18.
CVE-2026-25497High 8.6
Craft has a GraphQL Asset Mutation Privilege Escalation
Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.
CVE-2026-25496Medium 4.8
Craft has a stored XSS in Number Prefix & Suffix Fields
Affected: from 5.0.0-RC1, fixed in 5.8.22; from 4.0.0-RC1, fixed in 4.16.18.
CVE-2026-25495High 8.7
Craft has a SQL Injection in Element Indexes via criteria[orderBy]
Affected: from 5.0.0-RC1, fixed in 5.8.22; from 4.0.0-RC1, fixed in 4.16.18.
CVE-2026-25494Medium 6.9
Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation
Affected: from 5.0.0-RC1, fixed in 5.8.22; from 4.0.0-RC1, fixed in 4.16.18.
CVE-2026-25493Medium 6.9
Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect
Affected: from 5.0.0-RC1, fixed in 5.8.22; from 4.0.0-RC1, fixed in 4.16.18.
CVE-2026-25491Low 1.9
Craft has a Stored XSS in Entry Types Name
Affected: from 5.0.0-RC1, fixed in 5.8.22.
CVE-2025-68456High 7.0
Unauthenticated Craft CMS users can trigger a database backup
Affected: from 5.0.0-RC1, fixed in 5.8.21; from 3.0.0, fixed in 4.16.17.
CVE-2025-68455High 8.6
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
Affected: from 5.0.0-RC1, fixed in 5.8.21; from 4.0.0-RC1, fixed in 4.16.17.
CVE-2025-68454Medium 5.2
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
Affected: from 5.0.0-RC1, fixed in 5.8.21; from 4.0.0-RC1, fixed in 4.16.17.
CVE-2025-68437Medium 5.0
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
Affected: from 5.0.0-RC1, fixed in 5.8.21; from 3.5.0, fixed in 4.16.17.
CVE-2025-68436Medium 4.9
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
Affected: from 5.0.0-RC1, fixed in 5.8.21; from 4.0.0-RC1, fixed in 4.16.17.
CVE-2025-57811Medium 6.1
Craft Potential Remote Code Execution via Twig SSTI
Affected: from 4.0.0-RC1, fixed in 4.16.6; from 5.0.0-RC1, fixed in 5.8.7.
CVE-2025-54417Medium 5.2
Craft contains a theoretical bypass for CVE-2025-23209
Affected: from 4.13.8, fixed in 4.16.3; from 5.5.8, fixed in 5.8.4.
CVE-2025-35939Medium 5.3 · KEV
Craft CMS stores user-provided content in session files
Affected: from 5.0.0-alpha.1, fixed in 5.7.5; fixed in 4.15.3.
CVE-2025-46731High 7.3
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
Affected: from 4.0.0-RC1, fixed in 4.14.13; from 5.0.0-RC1, fixed in 5.6.15.
CVE-2025-32432Critical 10.0 · KEV
Craft CMS Allows Remote Code Execution
Affected: from 3.0.0-RC1, fixed in 3.9.15; from 4.0.0-RC1, fixed in 4.14.15; from 5.0.0-RC1, fixed in 5.6.17.
CVE-2025-23209High 8.1 · KEV
Potential RCE with a compromised security key in craft/cms
Affected: from 5.0.0-RC1, fixed in 5.5.8; from 4.0.0-RC1, fixed in 4.13.8.
CVE-2024-56145Critical 9.3 · KEV
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.13.2; from 3.0.0, fixed in 3.9.14.
CVE-2024-52291High 8.5
Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
Affected: from 5.0.0-RC1, fixed in 5.4.6; from 4.0.0-RC1, fixed in 4.12.5.
CVE-2024-52292High 7.7
Craft Allows Attackers to Read Arbitrary System Files
Affected: from 5.0.0-alpha.1, fixed in 5.4.9; from 3.5.13, fixed in 4.12.8.
CVE-2024-52293High 7.2
Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI
Affected: from 4.0.0-RC1, fixed in 4.12.2; from 5.0.0-RC1, fixed in 5.4.3.
CVE-2024-45406Medium 5.5
Craft CMS stored XSS in breadcrumb list and title fields
Affected: from 5.0.0, fixed in 5.1.2.
CVE-2024-41800Medium 4.8
Craft CMS Allows TOTP Token To Stay Valid After Use
Affected: from 5.0.0-beta.1, fixed in 5.2.3.
CVE-2024-37843High 7.5
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.
Affected: through 3.7.31.
CVE-2023-36260Unrated
An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS.
Affected: fixed in 4.6.2.
CVE-2024-21622Medium 5.4
Craft CMS Privilege Escalation
Affected: from 4.0.0-RC1, fixed in 4.5.11; from 3.0.0, fixed in 3.9.6.
CVE-2023-41892Critical 10.0
Craft CMS Remote Code Execution vulnerability
Affected: from 4.0.0-RC1, fixed in 4.4.15.
CVE-2023-40035High 7.2
Craft CMS vulnerable to Remote Code Execution via validatePath bypass
Affected: from 4.0.0-RC1, fixed in 4.4.15; from 3.0.0, fixed in 3.8.15.
CVE-2023-33495Medium 6.1
Craft CMS through 4.4.9 is vulnerable to HTML Injection.
Affected: through 4.4.9.
CVE-2023-33195Medium 5.0
Craft CMS XSS in RSS widget feed
Affected: from 4.3.0, fixed in 4.4.6.
CVE-2023-33194Low 3.7
CraftCMS stored XSS in Quick Post widget error message
Affected: from 4.0.0-RC1, fixed in 4.4.6; from 3.0.0, fixed in 3.8.6.
CVE-2023-33196Medium 5.5
Craft CMS stored XSS in review volume
Affected: from 4.0.0-RC1, fixed in 4.4.7.
CVE-2023-33197Medium 5.5
Craft CMS stored XSS in indexedVolumes
Affected: from 4.0.0-RC1, fixed in 4.4.6.
CVE-2023-2817Medium 5.4
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11.
Affected: from 4.0.0-RC1, fixed in 4.4.12.
CVE-2023-32679High 7.2
Remote Code Execution via unrestricted file extension in Craft CMS
Affected: from 4.0.0, fixed in 4.4.6.
CVE-2023-30130High 8.8
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
Affected: through 3.8.1.
CVE-2023-31144Medium 6.1
Craft CMS vulnerable to cross site scripting in RSS feed widget
Affected: from 3.0.0, fixed in 3.8.4; from 4.0.0, fixed in 4.4.4.
CVE-2023-30177Medium 6.1
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS).
Affected: fixed in 3.7.68.
CVE-2023-23927Medium 6.1
Craft CMS stored cross-site scripting vulnerability
Affected: from 4.0.0-RC1, fixed in 4.3.7; from 3.7.24, fixed in 3.7.64.
CVE-2022-37783Unrated
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username…
Affected: from 3.0.0, fixed in 3.7.33.
CVE-2022-37246Medium 5.4
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific…
Affected: from 4.0.0-RC1, fixed in 4.2.1; from 3.7.39, fixed in 3.7.51.
CVE-2022-37251Unrated
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.
Affected: from 3.7.0-beta.1, fixed in 3.7.55.2; from 4.0.0-RC1, fixed in 4.2.1.
CVE-2022-37247Unrated
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.
Affected: from 4.0.0-RC1, fixed in 4.2.1.
CVE-2022-37248Unrated
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.
Affected: from 4.0.0-RC1, fixed in 4.2.1.
CVE-2022-37250Medium 5.4
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.
Affected: from 4.0.0-RC1, fixed in 4.2.1.
CVE-2022-29933Unrated
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password…
Affected: fixed in 3.7.36.
CVE-2022-28378Unrated
Craft CMS before 3.7.29 allows XSS.
Affected: fixed in 3.7.29.
CVE-2021-41824Unrated
Craft CMS before 3.7.14 allows CSV injection.
Affected: from 3.4.0, fixed in 3.7.14.
CVE-2021-27903Unrated
An issue was discovered in Craft CMS before 3.6.7.
Affected: fixed in 3.6.7.
CVE-2021-27902Unrated
An issue was discovered in Craft CMS before 3.6.0.
Affected: fixed in 3.6.0.
CVE-2021-32470Unrated
Craft CMS before 3.6.13 has an XSS vulnerability.
Affected: fixed in 3.6.13.
CVE-2020-19626Unrated
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via…
Affected: fixed in 3.1.33.
CVE-2019-15929Unrated
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the…
Affected: fixed in 3.1.7.
CVE-2019-17496Unrated
Craft CMS before 3.3.8 has stored XSS via a name field.
Affected: fixed in 3.3.8.
CVE-2019-12823Unrated
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.
Affected: fixed in 3.1.31.
CVE-2018-20465Unrated
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as…
Affected: through 3.0.34.
CVE-2018-20418Unrated
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
Affected: through 3.0.25.
CVE-2018-3814Unrated
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace…
Affected: through 2.6.3000.
CVE-2017-9516Unrated
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
Affected: fixed in 2.6.2982.
CVE-2017-8385Unrated
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
Affected: fixed in 2.6.2976.
CVE-2017-8384Unrated
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need…
Affected: fixed in 2.6.2976.
CVE-2017-8383Unrated
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
Affected: fixed in 2.6.2976.
CVE-2017-8052Unrated
Craft CMS before 2.6.2974 allows XSS attacks.
Affected: fixed in 2.6.2974.