Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
180 results · page 3 of 4
Mar 16, 2026Craft CMS is a content management system (CMS).CVE-2026-32264 · Other software · craftcms · reported by GitHubHigh 8.6
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in versions 4.17.5 and 5.9.11.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Craft CMS is a content management system (CMS).CVE-2026-32263 · Other software · craftcms · reported by GitHubHigh 8.6
Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via "as" or "on" prefixed keys, the same attack vector as the original advisory. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in version 5.9.11.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Craft CMS is a content management system (CMS).CVE-2026-32262 · Other software · craftcms · reported by GitHubMedium 5.3
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename. This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root. This only affects local filesystems. This issue has been patched in versions 4.17.5 and 5.9.11.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events occur.CVE-2026-32261 · Other software · craftcms · reported by GitHubHigh 8.5
Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events occur. From version 3.0.0 to before version 3.2.0, the Webhooks plugin renders user-supplied template content through Twig’s renderString() function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions. This is possible even if allowAdminChanges is set to false. This issue has been patched in version 3.2.0.
- Product
- webhooks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-31867 · Websites & servers · craftcms · reported by GitHubMedium 6.3
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it. This vulnerability enables the takeover of shopping sessions and potential exposure of PII. This vulnerability is fixed in 4.11.0 and 5.6.0.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29177 · Websites & servers · craftcms · reported by GitHubLow 1.9
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29176 · Websites & servers · craftcms · reported by GitHubMedium 4.8
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The Name field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product. This vulnerability is fixed in 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29175 · Websites & servers · craftcms · reported by GitHubHigh 8.6
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability is fixed in 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29174 · Websites & servers · craftcms · reported by GitHubHigh 8.7
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an addOrderBy() clause without any validation or sanitization. An authenticated attacker with access to the Commerce Inventory section can inject arbitrary SQL queries, potentially leading to a full database compromise. This vulnerability is fixed in 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29173 · Websites & servers · craftcms · reported by GitHubLow 1.9
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This vulnerability is fixed in 4.10.2 and 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29172 · Websites & servers · craftcms · reported by GitHubHigh 8.7
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array key to orderBy() without whitelist validation. Yii2's query builder does NOT escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the ORDER BY clause. This vulnerability is fixed in 4.10.2 and 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool.CVE-2026-26188 · Other software · solspace · reported by GitHubMedium 5.1
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens. This vulnerability is fixed in 5.14.7.
- Product
- craft-freeform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Craft CMS is a content management system.CVE-2026-25492 · Other software · craftcms · reported by GitHubMedium 5.3
Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a non-image file extension such as .txt is allowed, downstream image validation is bypassed, which can allow an authenticated attacker with permission to use save_images_Asset to retrieve sensitive data such as AWS instance metadata credentials from the underlying host. This issue is patched in versions 4.16.18 and 5.8.22.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25522 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25490 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25489 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25488 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Tax Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25487 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator's browser. This occurs because the Tax Rates 'Name' field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25486 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in version 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25485 · Websites & servers · craftcms · reported by GitHubMedium 6.2
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25484 · Websites & servers · craftcms · reported by GitHubMedium 4.8
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input (source) is in Commerce (Product Type settings), but the sink is in CMS user permissions settings. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25483 · Websites & servers · craftcms · reported by GitHubMedium 6.2
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions (which do not require an elevated session), an attacker can exfiltrate the entire database, including all user credentials, customer PII, order history, and 2FA recovery codes. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25482 · Websites & servers · craftcms · reported by GitHubMedium 6.2
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025Craft CMS External Control of Assumed-Immutable Web Parameter VulnerabilityCVE-2025-35939 · Other software · Craft CMS · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 6.9
Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.
- Product
- Craft CMS
- On CISA’s list since
- Jun 2, 2025 (federal fix deadline Jun 23, 2025)
- What to do
- Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Apr 25, 2025Craft CMS Code Injection VulnerabilityCVE-2025-32432 · Other software · Craft CMS · reported by GitHubExploitedCritical 10
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
- Product
- Craft CMS
- On CISA’s list since
- Mar 20, 2026 (federal fix deadline Apr 3, 2026)
- What to do
- Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Apr 11, 2025Formie is a Craft CMS plugin for creating forms.CVE-2025-32427 · Other software · verbb · reported by GitHubMedium 5.3
Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export. This vulnerability is fixed in 2.1.44.
- Product
- formie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2025Formie is a Craft CMS plugin for creating forms.CVE-2025-32426 · Other software · verbb · reported by GitHubMedium 4.6
Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email). This would require access to the form's email notification settings. This has been fixed in Formie 2.1.44.
- Product
- formie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Craft CMS Code Injection VulnerabilityCVE-2025-23209 · Other software · Craft CMS · reported by GitHubExploitedHigh 8
Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.
- Product
- Craft CMS
- On CISA’s list since
- Feb 20, 2025 (federal fix deadline Mar 13, 2025)
- What to do
- Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcraftcms.comgithub.com
Dec 18, 2024Craft CMS Code Injection VulnerabilityCVE-2024-56145 · Other software · Craft CMS · reported by GitHubExploitedCritical 9.3
Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.
- Product
- Craft CMS
- On CISA’s list since
- Jun 2, 2025 (federal fix deadline Jun 23, 2025)
- What to do
- Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Jun 25, 2024Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.CVE-2024-37843 · Other software · craftcms · reported by MITRECritical 9.8
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.
- Product
- craft_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.smithsecurity.bizblog.smithsecurity.biz
May 20, 2024Formie is a Craft CMS plugin for creating forms.CVE-2024-35191 · Other software · verbb · reported by GitHubMedium 4.4
Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This has been fixed in Formie 2.1.6.
- Product
- formie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS.CVE-2023-36260 · Other software · Craftcms · reported by MITREHigh 7.5
An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security."
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.CVE-2023-36259 · Other software · Craftcms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Sep 13, 2023Craft CMS is a platform for creating digital experiences.CVE-2023-41892 · Other software · craftcms · reported by GitHubCritical 10
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 20, 2023Craft CMS through 4.4.9 is vulnerable to HTML Injection.CVE-2023-33495 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS through 4.4.9 is vulnerable to HTML Injection.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI).CVE-2023-30179 · Other software · Craftcms · reported by MITREHigh 7.2
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatnlq.gitbook.iogithub.com
May 26, 2023A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11.CVE-2023-2817 · Other software · Craftcms · reported by vulnreport@tenable.comMedium 5.4
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023Craft CMS is an open source content management system.CVE-2023-32679 · Other software · craftcms · reported by GitHubHigh 7.2
Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTemplate() -> _resolveTemplateInternal() -> _resolveTemplate() function, it returns directly without extension verification, so that arbitrary extension files are rendered as twig templates. When attacker with admin privileges on a DEV or an improperly configured STG or PROD environment, they can exploit this vulnerability to remote code execution. Code execution may grant the attacker access to the host operating system. This issue has been addressed in version 4.4.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.CVE-2023-30130 · Other software · Craftcms · reported by MITREHigh 8.8
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtf1t.gitbook.io
May 9, 2023Craft CMS is a content management system.CVE-2023-31144 · Other software · craftcms · reported by GitHubMedium 6.1
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS).CVE-2023-30177 · Other software · Craftcms · reported by MITREMedium 6.1
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens.CVE-2022-37783 · Other software · Craftcms · reported by MITREHigh 7.5
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comat-trustit.tuv.at
Sep 21, 2022Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elCVE-2022-37246 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.integrity.pt
Sep 16, 2022Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.CVE-2022-37251 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Sep 16, 2022Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.CVE-2022-37247 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.integrity.pt
Sep 16, 2022Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.CVE-2022-37248 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.integrity.pt
Sep 16, 2022Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.CVE-2022-37250 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.integrity.pt
Jun 12, 2022A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /inCVE-2021-41750 · Other software · Nystudio107 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2022In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remoCVE-2021-41749 · Other software · Nystudio107 · reported by MITRECritical 9.8
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2022Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the accoCVE-2022-29933 · Other software · Craftcms · reported by MITREHigh 8.8
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.