Skip to contentStatamic vulnerabilities
Newest
- max-3000 maxsite cms, maxsite cms +1 moreMaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted uploadCVE-2025-123465.3 Medium
- matthewdeaves willow cms, statamic cms +1 moreWillow CMS add unrestricted uploadCVE-2025-123315.1 Medium
- matthewdeaves willow cms, statamic cms +1 moreWillow CMS Add Post add cross site scriptingCVE-2025-123304.8 Medium
- e107 cms, e107 +1 moree107 CMS Avatar image.php path traversalCVE-2025-119415.3 Medium
- statamic cms, wanglongcn yifang +1 moreYiFang CMS Backend File.php webUploader unrestricted uploadCVE-2025-111365.1 Medium
- statamic cms, totaljs total.js +1 moreTotal.js CMS Files Menu cross site scriptingCVE-2025-110194.8 Medium
- statamic cms, totaljs total.js +1 moreTotal.js CMS Layout admin layouts_save cross site scriptingCVE-2025-109404.8 Medium
- craftcms cms, craft cms +1 moreCraft Potential Remote Code Execution via Twig SSTICVE-2025-57811Fix available6.1 Medium
- statamic cms, wanglongcn yifang +1 moreYiFang CMS P_file.php mergeMultipartUpload unrestricted uploadCVE-2025-94005.3 Medium
- statamic cms, wanglongcn yifang +1 moreYiFang CMS L_tool.php sql injectionCVE-2025-93995.3 Medium
- statamic cms, wanglongcn yifang +1 moreYiFang CMS Migrate.php exportInstallTable information disclosureCVE-2025-93986.9 Medium
- statamic cmsUmbraco CMS < 4.7.1 codeEditorSave.asmx RCECVE-2012-10054Public exploit9.3 Critical
- craftcms cms, craft cms +1 moreCraft contains a theoretical bypass for CVE-2025-23209CVE-2025-54417Fix available5.2 Medium
- 299ko cms299Ko CMS File Management view unrestricted uploadCVE-2025-82655.1 Medium
- builderengine cmsBuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File UploadCVE-2025-34100Public exploit9.3 Critical
- bolt cms, boltcms bolt +1 moreBolt CMS Authenticated Remote Code Execution via Profile Injection and File RenameCVE-2025-34086Public exploit7.5 High
- microweber, microweber ltd. cms +1 moreMicroweber CMS Authenticated Local File Inclusion via Backup APICVE-2025-34076Fix available6.1 Medium
- juzaweb cmsjuzaweb CMS Add New Themes Page install improper authorizationCVE-2025-67365.3 Medium
- juzaweb cmsjuzaweb CMS Import Page imports improper authorizationCVE-2025-67355.3 Medium
- marwal infotech cmsMarwal Infotech CMS page.php sql injectionCVE-2025-54356.9 Medium
- aem solutions cmsAem Solutions CMS page.php sql injectionCVE-2025-54346.9 Medium
- assamlook cmsAssamLook CMS view_tender.php sql injectionCVE-2025-54325.3 Medium
- assamlook cmsAssamLook CMS department-profile.php sql injectionCVE-2025-54315.3 Medium
- assamlook cmsAssamLook CMS product.php sql injectionCVE-2025-54305.3 Medium
- juzaweb cmsjuzaweb CMS Plugins Page install access controlCVE-2025-54295.3 Medium
- juzaweb cmsjuzaweb CMS Error Logs Page log-viewer access controlCVE-2025-54285.3 Medium
- juzaweb cmsjuzaweb CMS Permalinks Page permalinks access controlCVE-2025-54275.3 Medium
- juzaweb cmsjuzaweb CMS Menu Page menus access controlCVE-2025-54265.3 Medium
- juzaweb cmsjuzaweb CMS Theme Editor Page default access controlCVE-2025-54255.3 Medium
- juzaweb cmsjuzaweb CMS Media Page media access controlCVE-2025-54245.3 Medium
- juzaweb cmsjuzaweb CMS General Setting Page general access controlCVE-2025-54235.3 Medium
- juzaweb cmsjuzaweb CMS Email Logs Page email access controlCVE-2025-54225.3 Medium
- juzaweb cmsjuzaweb CMS Plugin Editor Page editor access controlCVE-2025-54215.3 Medium
- juzaweb cmsjuzaweb CMS Profile Page upload cross site scriptingCVE-2025-54205.1 Medium
- statamic cms, wanglongcn yifang +1 moreYifang CMS Article Management Module cross site scriptingCVE-2025-53834.8 Medium
- statamic cms, wanglongcn yifang +1 moreYifang CMS Admin Panel downloadFile path traversalCVE-2025-53815.1 Medium
- craft cms, craftcms craft cms +1 moreCraft CMS stores user-provided content in session filesCVE-2025-35939In KEVFix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTICVE-2025-46731Public exploitFix available7.3 High
- craft cms cms, craftcms craft cms +1 moreCraft CMS Allows Remote Code ExecutionCVE-2025-32432In KEVPublic exploitFix availableEPSS 99.8%10.0 Critical
- powercreator cmsPowerCreator CMS OpenPublicCourse.aspx sql injectionCVE-2025-35345.3 Medium
- jfinal cmsJFinal CMS readTemplate engine.getTemplate path traversalCVE-2025-3214Disputed5.3 Medium
- kentico cmsKentico CMS Additional Database Installation Wizard install.aspx cross site scriptingCVE-2025-28784.8 Medium
- odyssey cms, odysseyautomation odyssey cms +1 moreOdyssey CMS reCAPTCHA odyssey_contact_form.php key managementCVE-2025-22204.8 Medium
- dingfanzu cmsdingfanzu CMS loadShopInfo.php sql injectionCVE-2025-15445.3 Medium
- craft cms cms, craftcms craft cms +1 morePotential RCE with a compromised security key in craft/cmsCVE-2025-23209In KEVFix availableEPSS 21.6%8.1 High
- redaxo cms, redaxo +1 moreRedaxo CMS Structure Management Page index.php cross site scriptingCVE-2024-13209Fix available5.1 Medium
- statamic cmsTiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-479207.5 High
- statamic cmsTiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-479199.8 Critical
- statamic cmsTiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-479186.1 Medium
- craft cms cms, craftcms craft cms +1 moreRCE when PHP `register_argc_argv` config setting is enabled in craftcms/cmsCVE-2024-56145In KEVPublic exploitFix availableEPSS 97.5%9.3 Critical
- Show moreLoading…