statamic/cms vulnerabilities (Packagist)
44 vulnerabilities.
-
statamic/cmsPackagist Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template 6.1 Medium -
statamic/cmsPackagist Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types 5.3 Medium -
statamic/cmsPackagist Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries 6.5 Medium -
statamic/cmsPackagist Statamic: Unsafe method invocation via Antlers template resolution allows data destruction 6.5 Medium -
statamic/cmsPackagist Statamic: Account takeover via OAuth email matching without email-verification check 8.1 High -
statamic/cmsPackagist Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence 4.3 Medium -
statamic/cmsPackagist Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable 6.2 Medium -
statamic/cmsPackagist Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors 3.5 Low -
statamic/cmsPackagist Statamic: CSV formula injection in form submission exports 6.1 Medium -
statamic/cmsPackagist Statamic: Server-Side Request Forgery via Glide (DNS rebinding) 4.9 Medium -
statamic/cmsPackagist Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources 4.3 Medium -
statamic/cmsPackagist Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction 7.4 High -
statamic/cmsPackagist Statamic: Server-Side Request Forgery via Glide 5.4 Medium -
statamic/cmsPackagist Statamic: Email enumeration via forgot password endpoint 5.3 Medium -
statamic/cmsPackagist Statamic: Unsafe method invocation via query value resolution allows data destruction 8.1 High -
statamic/cmsPackagist Statamic allows unauthorized content access through missing authorization in its revision controllers 5.4 Medium -
statamic/cmsPackagist Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields 6.5 Medium -
statamic/cmsPackagist Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential 6.1 Medium -
statamic/cmsPackagist Statamic's live preview token bypasses content protection for unrelated entries 4.3 Medium -
statamic/cmsPackagist Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag 6.1 Medium -
statamic/cmsPackagist Statamic's Markdown preview endpoint exposes sensitive user data 6.5 Medium -
statamic/cmsPackagist Statamic is missing authorization check on taxonomy term creation via fieldtype 4.3 Medium -
statamic/cmsPackagist Statamic has a path traversal in file dictionary fieldtype 4.3 Medium -
statamic/cmsPackagist Statamic has Stored XSS via SVG Sanitization Bypass 8.7 High -
statamic/cmsPackagist Statamic: privilege escalation via stored cross-site scripting 5.4 Medium -
statamic/cmsPackagist Statamic vulnerable to privilege escalation via stored cross-site scripting 8.7 High -
statamic/cmsPackagist Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs 8.0 High -
statamic/cmsPackagist Statamic's missing authorization allows access to email addresses 6.5 Medium -
statamic/cmsPackagist Statamic Vulnerable to Server-Side Request Forgery via Glide 6.8 Medium -
statamic/cmsPackagist Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass 8.8 High -
statamic/cmsPackagist Statamic is vulnerable to account takeover via password reset link injection 9.3 Critical -
statamic/cmsPackagist Statamic affected by privilege escalation via stored Cross-site Scripting 8.1 High -
statamic/cmsPackagist Statmatic affected by privilege escalation via stored cross-site scripting 8.7 High -
statamic/cmsPackagist Statamic's missing authorization allows access to assets 4.3 Medium -
statamic/cmsPackagist Statmatic vulnerable to Stored Cross-Site Scripting 8.0 High -
statamic/cmsPackagist Statamic CMS has Path Traversal in Asset Upload 5.3 Medium -
statamic/cmsPackagist Password confirmation stored in plain text via registration form in statamic/cms 1.8 Low -
statamic/cmsPackagist Statamic account takeover via XSS and password reset link 8.2 High -
statamic/cmsPackagist Statamic CMS vulnerable to Cross-site Scripting via uploaded assets 7.5 High -
statamic/cmsPackagist Remote code execution via form uploads in statamic/cms 8.8 High -
statamic/cmsPackagist Statamic CMS remote code execution via front-end form uploads 8.4 High -
statamic/cmsPackagist Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG 5.5 Medium -
statamic/cmsPackagist Discoverability of user password hash in Statamic CMS 3.7 Low -
statamic/cmsPackagist Statamic framework Incorrect Permission Assignment 8.8 High