Craft CMS vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
153 matching records
- Critical9.8Yiiframework Yii Improper Protection of Alternate Path VulnerabilityPatch nowKEVEPSS 87.76%Apr 9, 2025
- High8.1Craft CMS Code Injection VulnerabilityPatch nowKEVEPSS 21.64%Jan 17, 2025
- Critical9.3Craft CMS Code Injection VulnerabilityPatch nowKEVEPSS 97.48%Dec 18, 2024
- Medium6.5CVE-2024-52292 is listed by Craft is a content management system (CMS)..Check if you run itEPSS 0.75%Nov 13, 2024
- High7.2CVE-2024-52291 is listed by Craft is a content management system (CMS)..Check if you run itEPSS 1.25%Nov 13, 2024
- High7.2CVE-2024-52293 is listed by Craft is a content management system (CMS)..Check if you run itEPSS 1.36%Nov 13, 2024
- Medium4.8CVE-2024-45406 is listed by Craft is a content management system (CMS)..Check if you run itEPSS 0.35%Sep 9, 2024
- High7.5CVE-2024-41800 is listed by Craft is a content management system (CMS)..Check if you run itEPSS 0.46%Jul 25, 2024
- Critical9.8Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.Check this weekEPSS 53.24%Jun 25, 2024
- High7.5An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS.Check if you run itEPSS 1.07%Jan 30, 2024
- Medium5.4Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.Check if you run itEPSS 0.38%Jan 30, 2024
- High8.8CVE-2024-21622 is listed by Craft is a content management system..Check if you run itEPSS 0.59%Jan 3, 2024
- Critical9.8craftcms Craft CMS Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 94.22%Sep 13, 2023
- High7.2Craft is a CMS for creating custom digital experiences on the web and beyond.Check if you run itEPSS 2.32%Aug 23, 2023
- Medium6.1Craft CMS through 4.4.9 is vulnerable to HTML Injection.Check if you run itEPSS 0.50%Jun 20, 2023
- High7.2CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI).Check if you run itEPSS 2.20%Jun 13, 2023
- Medium6.1CVE-2023-33195 is listed by Craft is a CMS for creating custom digital experiences on the web..Check if you run itEPSS 0.65%May 27, 2023
- Medium5.4Craft is a CMS for creating custom digital experiences.Check if you run itEPSS 0.65%May 26, 2023
- Medium4.8Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which ca…Check if you run itEPSS 0.62%May 26, 2023
- Medium5.4CVE-2023-33197 is listed by Craft is a CMS for creating custom digital experiences on the web..Check if you run itEPSS 0.68%May 26, 2023
- Medium5.4A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11.Check if you run itEPSS 0.44%May 26, 2023
- High7.2Craft CMS is an open source content management system.Check if you run itEPSS 1.85%May 19, 2023
- High8.8An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.Check if you run itEPSS 1.42%May 12, 2023
- Medium6.1CVE-2023-31144 is listed by Craft CMS is a content management system..Check if you run itEPSS 0.41%May 9, 2023
- Medium6.1CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS).Check if you run itEPSS 0.40%Apr 25, 2023