craftcms/cms vulnerabilities (Packagist)
128 vulnerabilities.
craftcms/cmsPackagistCraft is affected by potential authenticated Remote Code Execution via Twig SSTI8.6 Highcraftcms/cmsPackagistCraft has a Permission Bypass and IDOR in Duplicate Entry Action5.3 Mediumcraftcms/cmsPackagistCraft has a Twig Function Blocklist Bypass9.4 Criticalcraftcms/cmsPackagistCraft Affected by Entries Authorship Spoofing via Mass Assignment7.1 Highcraftcms/cmsPackagistCraft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates9.4 Criticalcraftcms/cmsPackagistCraft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options4.6 Mediumcraftcms/cmsPackagistCraft affected by IDOR via GraphQL @parseRefs8.7 Highcraftcms/cmsPackagistCraft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget7.5 Highcraftcms/cmsPackagistCraft CMS - Stored XSS in Table Field via Row Heading Column Type4.6 Mediumcraftcms/cmsPackagistCloud Metadata SSRF Protection Bypass via IPv6 Resolution5.7 Mediumcraftcms/cmsPackagistCraft CMS's race condition in Token Service potentially allows for token usage greater than the token limit6.9 Mediumcraftcms/cmsPackagistCraft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding7.0 Highcraftcms/cmsPackagistCraft CMS has Stored XSS in Table Field via "HTML" Column Type5.9 Mediumcraftcms/cmsPackagistCraft has a potential authenticated Remote Code Execution via malicious attached Behavior8.6 Highcraftcms/cmsPackagistCraft has a GraphQL Asset Mutation Privilege Escalation8.6 Highcraftcms/cmsPackagistCraft has a stored XSS in Number Prefix & Suffix Fields4.8 Mediumcraftcms/cmsPackagistCraft has a SQL Injection in Element Indexes via criteria[orderBy]8.7 Highcraftcms/cmsPackagistCraft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation6.9 Mediumcraftcms/cmsPackagistCraft has a SSRF in GraphQL Asset Mutation via HTTP Redirect6.9 Mediumcraftcms/cmsPackagistCraft has a Stored XSS in Entry Types Name1.9 Lowcraftcms/cmsPackagistCraft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior8.6 Highcraftcms/cmsPackagistUnauthenticated Craft CMS users can trigger a database backup7.0 Highcraftcms/cmsPackagistCraft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI5.2 Mediumcraftcms/cmsPackagistCraft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation5.0 Mediumcraftcms/cmsPackagistCraft CMS vulnerable to potential information disclosure via unchecked asset relocation4.9 Mediumcraftcms/cmsPackagistCraft Potential Remote Code Execution via Twig SSTI6.1 Mediumcraftcms/cmsPackagistCraft contains a theoretical bypass for CVE-2025-232095.2 Mediumcraftcms/cmsPackagistCraft CMS stores user-provided content in session files6.9 Mediumcraftcms/cmsPackagistCraft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI7.3 Highcraftcms/cmsPackagistCraft CMS Allows Remote Code Execution10.0 Criticalcraftcms/cmsPackagistPotential RCE with a compromised security key in craft/cms8.1 Highcraftcms/cmsPackagistRCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms9.3 Criticalcraftcms/cmsPackagistCraft has a Potential Remote Code Execution via missing path normalization & Twig SSTI7.2 Highcraftcms/cmsPackagistCraft Allows Attackers to Read Arbitrary System Files7.7 Highcraftcms/cmsPackagistCraft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution8.5 Highcraftcms/cmsPackagistCraft CMS stored XSS in breadcrumb list and title fields5.5 Mediumcraftcms/cmsPackagistCraft CMS Allows TOTP Token To Stay Valid After Use4.8 Mediumcraftcms/cmsPackagistCraft CMS SQL injection vulnerability via the GraphQL API endpoint9.8 Criticalcraftcms/cmsPackagistCraft CMS Feed-Me7.5 Highcraftcms/cmsPackagistCraft CMS Privilege Escalation5.4 Mediumcraftcms/cmsPackagistCraft CMS Remote Code Execution vulnerability10.0 Criticalcraftcms/cmsPackagistCraft CMS vulnerable to Remote Code Execution via validatePath bypass7.2 Highcraftcms/cmsPackagistCraft CMS vulnerable to HTML injection6.1 Mediumcraftcms/cmsPackagistCraft CMS stored XSS in indexedVolumes5.5 Mediumcraftcms/cmsPackagistCraft CMS stored XSS in review volume5.5 Mediumcraftcms/cmsPackagistCraft CMS XSS in RSS widget feed5.0 Mediumcraftcms/cmsPackagistCraftCMS stored XSS in Quick Post widget error message3.7 Lowcraftcms/cmsPackagistStored cross site scripting in Craft CMS5.4 Mediumcraftcms/cmsPackagistRemote Code Execution via unrestricted file extension in Craft CMS7.2 Highcraftcms/cmsPackagistCraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter8.8 High- Show moreLoading…