craftcms/cms vulnerabilities (TuxCare)
40 vulnerabilities.
-
craftcms/cmsTuxCare Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE 8.7 High -
craftcms/cmsTuxCare Control panel only API response emulation replaces "securityKey" and reaches server RCE 8.7 High -
craftcms/cmsTuxCare Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget 7.4 High -
craftcms/cmsTuxCare Craft CMS: Stored XSS via Structure entry title in table view 5.9 Medium -
craftcms/cmsTuxCare Craft CMS - Missing Authorization in assets/preview-thumb Endpoint 5.3 Medium -
craftcms/cmsTuxCare Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController 8.6 High -
craftcms/cmsTuxCare Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations 5.5 Medium -
craftcms/cmsTuxCare Craft CMS - Authorization Bypass in assets/preview-file Endpoint 5.3 Medium -
craftcms/cmsTuxCare Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users 1.3 Low -
craftcms/cmsTuxCare Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL 2.7 Low -
craftcms/cmsTuxCare Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users 6.9 Medium -
craftcms/cmsTuxCare Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) 4.9 Medium -
craftcms/cmsTuxCare Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior 8.6 High -
craftcms/cmsTuxCare Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() 7.7 High -
craftcms/cmsTuxCare Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController 8.6 High -
craftcms/cmsTuxCare Craft CMS has a Path Traversal Vulnerability in AssetsController 5.3 Medium -
craftcms/cmsTuxCare Craft has Reflective XSS via incomplete return URL sanitization 6.9 Medium -
craftcms/cmsTuxCare Craft has a potential information disclosure vulnerability in preview tokens 2.3 Low -
craftcms/cmsTuxCare Craft has an unauthenticated activation email trigger with potential user enumeration 6.9 Medium -
craftcms/cmsTuxCare Craft has a Twig Function Blocklist Bypass 9.4 Critical -
craftcms/cmsTuxCare Craft CMS - Stored XSS in Table Field via Row Heading Column Type 4.6 Medium -
craftcms/cmsTuxCare Cloud Metadata SSRF Protection Bypass via IPv6 Resolution 5.7 Medium -
craftcms/cmsTuxCare Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit 6.9 Medium -
craftcms/cmsTuxCare Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding 7.0 High -
craftcms/cmsTuxCare Craft has a potential authenticated Remote Code Execution via malicious attached Behavior 8.6 High -
craftcms/cmsTuxCare Craft has a stored XSS in Number Prefix & Suffix Fields 4.8 Medium -
craftcms/cmsTuxCare Craft has a SQL Injection in Element Indexes via criteria[orderBy] 8.7 High -
craftcms/cmsTuxCare Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation 6.9 Medium -
craftcms/cmsTuxCare Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect 6.9 Medium -
craftcms/cmsTuxCare Unauthenticated Craft CMS users can trigger a database backup 7.0 High -
craftcms/cmsTuxCare Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI 5.2 Medium -
craftcms/cmsTuxCare Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation 5.0 Medium -
craftcms/cmsTuxCare Craft Potential Remote Code Execution via Twig SSTI 6.1 Medium -
craftcms/cmsTuxCare Craft contains a theoretical bypass for CVE-2025-23209 5.2 Medium -
craftcms/cmsTuxCare Craft CMS stores user-provided content in session files 6.9 Medium -
craftcms/cmsTuxCare Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI 7.3 High -
craftcms/cmsTuxCare Craft Allows Attackers to Read Arbitrary System Files 7.7 High -
craftcms/cmsTuxCare Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution 8.5 High -
craftcms/cmsTuxCare Craft CMS vulnerable to HTML injection 6.1 Medium -
craftcms/cmsTuxCare Improper account password reset in Craft CMS 8.8 High