Craft CMS vulnerabilities

Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.

7 matching records

Medium6.9Craft CMS External Control of Assumed-Immutable Web Parameter VulnerabilityVuln · CVE-2025-35939 · craftcms · craft cms · CISA KEV · CVE.org · FIRST EPSS · Craft CMSPatch nowKEVEPSS 1.35%May 7, 2025
Critical10.0Craft CMS Code Injection VulnerabilityVuln · CVE-2025-32432 · Cloudflare · CMS · CISA KEV · Cloudflare WAF rules · CVE.org · Craft CMSPatch nowKEVEPSS 99.79%Apr 18, 2025
Critical9.8Yiiframework Yii Improper Protection of Alternate Path VulnerabilityVuln · CVE-2024-58136 · Yiiframework · Yii · AttackerKB · CISA KEV · CVE.org · Craft CMSPatch nowKEVEPSS 87.76%Apr 9, 2025
High8.1Craft CMS Code Injection VulnerabilityVuln · CVE-2025-23209 · Craft CMS · Craft CMS · CISA KEV · CVE.org · FIRST EPSS · Craft CMSPatch nowKEVEPSS 21.64%Jan 17, 2025
Critical9.3Craft CMS Code Injection VulnerabilityVuln · CVE-2024-56145 · Cloudflare · Craft CMS · CISA KEV · Cloudflare WAF rules · CVE.org · Craft CMSPatch nowKEVEPSS 97.48%Dec 18, 2024
Critical9.8craftcms Craft CMS Improper Control of Generation of Code ('Code Injection')Vuln · CVE-2023-41892 · craftcms · craft cms · CVE.org · FIRST EPSS · Monitored products — high · Craft CMSPatch nowKEVEPSS 94.22%Sep 13, 2023
Critical9.8craftcms Craft CMS Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Vuln · CVE-2020-9757 · craftcms · craft cms · CVE.org · FIRST EPSS · Monitored products — high · Craft CMSPatch nowKEVEPSS 72.82%Mar 4, 2020

Sort