craftcms/cms vulnerabilities (Packagist)
128 vulnerabilities.
-
craftcms/cmsPackagist Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey 7.1 High -
craftcms/cmsPackagist Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject 8.7 High -
craftcms/cmsPackagist Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak 7.1 High -
craftcms/cmsPackagist Craft CMS before 5.10.6 Authorization Bypass via structures/move-element 9.3 Critical -
craftcms/cmsPackagist Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained 6.9 Medium -
craftcms/cmsPackagist Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name 5.1 Medium -
craftcms/cmsPackagist Arbitrary user password reset leading to administrator account takeover 8.7 High -
craftcms/cmsPackagist Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset 7.1 High -
craftcms/cmsPackagist Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape 8.7 High -
craftcms/cmsPackagist Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config 8.7 High -
craftcms/cmsPackagist Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization 5.3 Medium -
craftcms/cmsPackagist Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization 5.3 Medium -
craftcms/cmsPackagist Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves 4.9 Medium -
craftcms/cmsPackagist Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements 7.1 High -
craftcms/cmsPackagist Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check 6.0 Medium -
craftcms/cmsPackagist Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap 7.6 High -
craftcms/cmsPackagist Craft CMS: Potential authenticated Remote Code Execution via referrer redirect 8.7 High -
craftcms/cmsPackagist Craft CMS: Sensitive File Disclosure / Server-Side File Read 6.0 Medium -
craftcms/cmsPackagist Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget 7.4 High -
craftcms/cmsPackagist Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets 7.1 High -
craftcms/cmsPackagist Craft CMS: Unauthorized Deletion of Source Assets During File Replacement 5.3 Medium -
craftcms/cmsPackagist Craft CMS: Stored XSS via Structure entry title in table view 5.9 Medium -
craftcms/cmsPackagist Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter 7.1 High -
craftcms/cmsPackagist Craft CMS - Missing Authorization in assets/preview-thumb Endpoint 5.3 Medium -
craftcms/cmsPackagist Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController 8.6 High -
craftcms/cmsPackagist Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs 6.9 Medium -
craftcms/cmsPackagist Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure 7.1 High -
craftcms/cmsPackagist Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior 8.6 High -
craftcms/cmsPackagist Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure 7.1 High -
craftcms/cmsPackagist Craft CMS has a host header injection leading to SSRF via resource-js endpoint 5.5 Medium -
craftcms/cmsPackagist Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations 5.5 Medium -
craftcms/cmsPackagist Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action 5.3 Medium -
craftcms/cmsPackagist Craft CMS - Authorization Bypass in assets/preview-file Endpoint 5.3 Medium -
craftcms/cmsPackagist Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions 4.9 Medium -
craftcms/cmsPackagist Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users 1.3 Low -
craftcms/cmsPackagist Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL 2.7 Low -
craftcms/cmsPackagist Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users 6.9 Medium -
craftcms/cmsPackagist Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) 4.9 Medium -
craftcms/cmsPackagist Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior 8.6 High -
craftcms/cmsPackagist Craft CMS Vulnerable to Stored XSS in Revision Context Menu 5.3 Medium -
craftcms/cmsPackagist Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() 7.7 High -
craftcms/cmsPackagist Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController 8.6 High -
craftcms/cmsPackagist Craft CMS vulnerable to behavior injection RCE via EntryTypesController 8.6 High -
craftcms/cmsPackagist Craft CMS has a Path Traversal Vulnerability in AssetsController 5.3 Medium -
craftcms/cmsPackagist Craft CMS - Stored XSS via User Group Name in User Permissions Page 4.6 Medium -
craftcms/cmsPackagist CraftCMS has an RCE vulnerability via relational conditionals in the control panel 8.1 High -
craftcms/cmsPackagist CraftCMS's `ElementSearchController` Affected by Blind SQL Injection 8.7 High -
craftcms/cmsPackagist Craft has Reflective XSS via incomplete return URL sanitization 6.9 Medium -
craftcms/cmsPackagist Craft has a potential information disclosure vulnerability in preview tokens 2.3 Low -
craftcms/cmsPackagist Craft has an unauthenticated activation email trigger with potential user enumeration 6.9 Medium - Show olderLoading…