Skip to contentCraftcms Craft Cms vulnerabilities
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in breadcrumb list and title fieldsCVE-2024-45406Fix available5.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS Allows TOTP Token To Stay Valid After UseCVE-2024-41800Fix available4.8 Medium
- craftcms craft cmsCraft CMS SQL injection vulnerability via the GraphQL API endpointCVE-2024-37843Public exploitEPSS 53.2%9.8 Critical
- craftcms craft cmsCraft CMS Feed-MeCVE-2023-36260Fix availableDisputed7.5 High
- craftcms craft cmsCraft CMS Audit Plugin Cross Site Scripting vulnerabilityCVE-2023-36259Fix available5.4 Medium
- craftcms cms, craft cms +1 moreCraft CMS Privilege EscalationCVE-2024-21622Fix available5.4 Medium
- craftcms cms, craft cms +1 moreCraft CMS Remote Code Execution vulnerabilityCVE-2023-41892Public exploitFix availableEPSS 94.2%10.0 Critical
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to Remote Code Execution via validatePath bypassCVE-2023-40035Fix available7.2 High
- craftcms craft cmsCraft CMS vulnerable to HTML injectionCVE-2023-334956.1 Medium
- craftcms craft cmsWithdrawn Advisory: CraftCMS Server-Side Template Injection vulnerabilityCVE-2023-30179Disputed7.2 High
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in indexedVolumesCVE-2023-33197Fix available5.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in review volumeCVE-2023-33196Fix available5.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS XSS in RSS widget feedCVE-2023-33195Fix available5.0 Medium
- craftcms cms, craft cms, craftercms +2 moreCraftCMS stored XSS in Quick Post widget error messageCVE-2023-33194Fix available3.7 Low
- craftcms craft cmsStored cross site scripting in Craft CMSCVE-2023-2817Fix available5.4 Medium
- craftcms cms, craft cms +1 moreRemote Code Execution via unrestricted file extension in Craft CMSCVE-2023-32679Fix available7.2 High
- craftcms craft cmsCraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameterCVE-2023-301308.8 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to cross site scripting in RSS feed widgetCVE-2023-31144Fix available6.1 Medium
- craftcms craft cmsCross Site Scripting in CraftCMSCVE-2023-30177Fix available6.1 Medium
- craftcms cms, craft cms +1 moreCraft CMS stored cross-site scripting vulnerabilityCVE-2023-23927Fix available6.1 Medium
- craftcms craft cmsCraft CMS discloses password hashesCVE-2022-37783Fix available7.5 High
- craftcms craft cmsCraft CMS Cross-site Scripting vulnerabilityCVE-2022-37246Fix available5.4 Medium
- craftcms craft cmsCraft CMS vulnerable to Cross-site Scripting via entry revisions and draftsCVE-2022-37251Fix available5.4 Medium
- craftcms craft cmsCraft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields pageCVE-2022-37247Fix available5.4 Medium
- craftcms craft cmsCraft CMS Cross site Scripting vulnerabilityCVE-2022-37248Fix available5.4 Medium
- craftcms craft cmsCraft CMS Stored Cross-site Scripting in User Addresses TitleCVE-2022-37250Fix available5.4 Medium
- craftcms craft cmsImproper account password reset in Craft CMSCVE-2022-29933Fix available8.8 High
- craftcms craft cmsCross-site Scripting in craftcms/cmsCVE-2022-28378Fix available6.1 Medium
- craftcms craft cmsCSV Injection VulnerabilityCVE-2021-41824Fix available8.8 High
- craftcms craft cmsCraft CMS Remote Code InjectionCVE-2021-27903Fix available9.8 Critical
- craftcms craft cmsCraft CMS Cross-site Scripting VulnerabilityCVE-2021-27902Fix available6.1 Medium
- craftcms craft cmsCraft CMS Cross-site Scripting VulnerabilityCVE-2021-32470Fix available6.1 Medium
- craftcms craft cmsCraft CMS Cross-site Scripting VulnerabilityCVE-2020-19626Fix available5.4 Medium
- craftcms craft cmsSEOmatic for CraftCMS allows Server-Side Template InjectionCVE-2020-9757Fix availableEPSS 72.8%9.8 Critical
- craftcms craft cmsIn the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field...CVE-2019-9554Public exploit6.1 Medium
- craftcms craft cmsCraft CMS possibility of brute force attemptsCVE-2019-15929Fix available9.8 Critical
- craftcms craft cmsCraft CMS XSS VulnerabilityCVE-2019-17496Fix available6.1 Medium
- craftcms craft cmsIn some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from...CVE-2019-14280Public exploit5.3 Medium
- craftcms craft cmsCraft CMS XSS VulnerabilityCVE-2019-12823Fix available6.1 Medium
- craftcms craft cmsCraft CMS Vulnerable to Server-Side Template InjectionCVE-2018-204657.2 High
- craftcms craft cmsCraft CMS Cross-site Scripting (XSS) VulnerabilityCVE-2018-20418Public exploit4.8 Medium
- craftcms craft cmsCraft CMS PHP Code Injection VulnerabilityCVE-2018-38148.8 High
- craftcms craft cmsCraft CMS XSS VulnerabilityCVE-2017-9516Public exploitFix available5.4 Medium
- craftcms craft cmsCraft CMS subject to URL forgeryCVE-2017-8385Fix available5.3 Medium
- craftcms craft cmsCraft CMS XSS VulnerabilityCVE-2017-8384Fix available6.1 Medium
- craftcms craft cmsCraft CMS Unauthorized ViewCVE-2017-8383Fix available5.3 Medium
- craftcms craft cmsCraft CMS XSS VulnerabilityCVE-2017-8052Fix available6.1 Medium