Craft CMS vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
153 matching records
- Medium5.4CVE-2023-23927 is listed by Craft is a platform for creating digital experiences..Check if you run itEPSS 0.80%Mar 3, 2023
- High7.5All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens.Check if you run itEPSS 1.11%Dec 5, 2022
- Medium5.4Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.Check if you run itEPSS 0.52%Sep 21, 2022
- Medium5.4Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.Check if you run itEPSS 0.50%Sep 16, 2022
- Medium5.4Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.Check if you run itEPSS 0.57%Sep 16, 2022
- Medium5.4Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.Check if you run itEPSS 0.66%Sep 16, 2022
- Medium5.4Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.Check if you run itEPSS 0.67%Sep 16, 2022
- High8.8Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by…Check if you run itEPSS 4.58%May 9, 2022
- Medium6.1Craft CMS before 3.7.29 allows XSS.Check if you run itEPSS 0.63%Apr 3, 2022
- High8.8Craft CMS before 3.7.14 allows CSV injection.Check if you run itEPSS 1.37%Sep 30, 2021
- Critical9.8An issue was discovered in Craft CMS before 3.6.7.Check if you run itEPSS 2.82%Jun 30, 2021
- Medium6.1An issue was discovered in Craft CMS before 3.6.0.Check if you run itEPSS 0.99%Jun 30, 2021
- Medium6.1Craft CMS before 3.6.13 has an XSS vulnerability.Check if you run itEPSS 0.73%May 7, 2021
- Medium5.4Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.Check if you run itEPSS 0.85%Mar 26, 2021
- Critical9.8craftcms Craft CMS Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 72.82%Mar 4, 2020
- Medium6.1In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.Check if you run itEPSS 3.71%Dec 31, 2019
- Critical9.8In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.Check if you run itEPSS 1.75%Oct 24, 2019
- Medium6.1Craft CMS before 3.3.8 has stored XSS via a name field.Check if you run itEPSS 0.84%Oct 11, 2019
- Medium5.3In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially expos…Check if you run itEPSS 9.36%Jul 26, 2019
- Medium6.1Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.Check if you run itEPSS 0.94%Jun 18, 2019
- High7.2Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string fo…Check if you run itEPSS 1.53%Dec 25, 2018
- Medium4.8index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.Check if you run itEPSS 3.70%Dec 24, 2018
- High8.8Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allo…Check if you run itEPSS 1.88%Jan 1, 2018
- Medium5.4Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.Check if you run itEPSS 2.80%Jun 8, 2017
- Medium5.3Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.Check if you run itEPSS 0.96%May 1, 2017