Craftcms vulnerabilities
175 CVEs and advisories name Craftcms as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-32271Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
- CVE-2026-32270Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments
- CVE-2026-33162Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions
- CVE-2026-33161Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users
- CVE-2026-33160Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL
- CVE-2026-33159Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users
- CVE-2026-33158Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
- CVE-2026-33157Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
- CVE-2026-33051Craft CMS Vulnerable to Stored XSS in Revision Context Menu
- CVE-2026-32268Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability
- CVE-2026-32266Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability
- CVE-2026-32265Amazon S3 for Craft CMS has an Information Disclosure vulnerability
- CVE-2026-32267Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
- CVE-2026-32264Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
- CVE-2026-32263Craft CMS vulnerable to behavior injection RCE via EntryTypesController
- CVE-2026-32262Craft CMS has a Path Traversal Vulnerability in AssetsController
- CVE-2026-32261RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
- CVE-2026-31867Craft Commerce has a Potential IDOR in Commerce carts
- CVE-2026-31859Craft has Reflective XSS via incomplete return URL sanitization
- CVE-2026-31858CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
- CVE-2026-31857CraftCMS has an RCE vulnerability via relational conditionals in the control panel
- CVE-2026-29177Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout
- CVE-2026-29176Craft Commerce has Stored XSS in Inventory Location Name
- CVE-2026-29175Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking
- CVE-2026-29174Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting
- CVE-2026-29173Craft Commerce has Stored XSS while updating Order Status from Orders Table
- CVE-2026-29172Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
- CVE-2026-29113Craft has a potential information disclosure vulnerability in preview tokens
- CVE-2026-29069Craft has an unauthenticated activation email trigger with potential user enumeration
- CVE-2026-28784Craft is affected by potential authenticated Remote Code Execution via Twig SSTI