Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
199 results · page 4 of 4
Sep 9, 2024Craft is a content management system (CMS).CVE-2024-45406 · Other software · craftcms · reported by GitHubMedium 5.5
Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2024Craft is a content management system (CMS).CVE-2024-41800 · Other software · craftcms · reported by GitHubMedium 4.8
Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.CVE-2024-37843 · Other software · craftcms · reported by MITRECritical 9.8
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.
- Product
- craft_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.smithsecurity.bizblog.smithsecurity.biz
Jun 6, 2024The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.CVE-2024-5658 · Other software · Born05 · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aMedium 4.8
The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.
- Product
- CraftCMS Plugin - Two-Factor Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Jun 6, 2024The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submittinCVE-2024-5657 · Other software · Born05 · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aLow 3.7
The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.
- Product
- CraftCMS Plugin - Two-Factor Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Jan 30, 2024An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS.CVE-2023-36260 · Other software · Craftcms · reported by MITREHigh 7.5
An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security."
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.CVE-2023-36259 · Other software · Craftcms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Jan 3, 2024Craft is a content management system.CVE-2024-21622 · Other software · craftcms · reported by GitHubMedium 5.4
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023Craft CMS is a platform for creating digital experiences.CVE-2023-41892 · Other software · craftcms · reported by GitHubCritical 10
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 23, 2023Craft is a CMS for creating custom digital experiences on the web and beyond.CVE-2023-40035 · Other software · craftcms · reported by GitHubHigh 7.2
Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Craft CMS through 4.4.9 is vulnerable to HTML Injection.CVE-2023-33495 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS through 4.4.9 is vulnerable to HTML Injection.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI).CVE-2023-30179 · Other software · Craftcms · reported by MITREHigh 7.2
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatnlq.gitbook.iogithub.com
May 27, 2023Craft is a CMS for creating custom digital experiences on the web.CVE-2023-33195 · Other software · craftcms · reported by GitHubMedium 5
Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Craft is a CMS for creating custom digital experiences.CVE-2023-33196 · Other software · craftcms · reported by GitHubMedium 5.5
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, wCVE-2023-33194 · Other software · craftcms · reported by GitHubLow 3.7
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Craft is a CMS for creating custom digital experiences on the web.CVE-2023-33197 · Other software · craftcms · reported by GitHubMedium 5.5
Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11.CVE-2023-2817 · Other software · Craftcms · reported by vulnreport@tenable.comMedium 5.4
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023Craft CMS is an open source content management system.CVE-2023-32679 · Other software · craftcms · reported by GitHubHigh 7.2
Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTemplate() -> _resolveTemplateInternal() -> _resolveTemplate() function, it returns directly without extension verification, so that arbitrary extension files are rendered as twig templates. When attacker with admin privileges on a DEV or an improperly configured STG or PROD environment, they can exploit this vulnerability to remote code execution. Code execution may grant the attacker access to the host operating system. This issue has been addressed in version 4.4.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.CVE-2023-30130 · Other software · Craftcms · reported by MITREHigh 8.8
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtf1t.gitbook.io
May 9, 2023Craft CMS is a content management system.CVE-2023-31144 · Other software · craftcms · reported by GitHubMedium 6.1
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS).CVE-2023-30177 · Other software · Craftcms · reported by MITREMedium 6.1
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023Craft is a platform for creating digital experiences.CVE-2023-23927 · Other software · craftcms · reported by GitHubMedium 6.1
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens.CVE-2022-37783 · Other software · Craftcms · reported by MITREHigh 7.5
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comat-trustit.tuv.at
Sep 21, 2022Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elCVE-2022-37246 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.integrity.pt
Sep 16, 2022Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.CVE-2022-37251 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Sep 16, 2022Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.CVE-2022-37247 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.integrity.pt
Sep 16, 2022Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.CVE-2022-37248 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.integrity.pt
Sep 16, 2022Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.CVE-2022-37250 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.integrity.pt
May 9, 2022Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the accoCVE-2022-29933 · Other software · Craftcms · reported by MITREHigh 8.8
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 3, 2022Craft CMS before 3.7.29 allows XSS.CVE-2022-28378 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 3.7.29 allows XSS.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2021Craft CMS before 3.7.14 allows CSV injection.CVE-2021-41824 · Other software · Craftcms · reported by MITREHigh 8.8
Craft CMS before 3.7.14 allows CSV injection.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021An issue was discovered in Craft CMS before 3.6.7.CVE-2021-27903 · Other software · Craftcms · reported by MITRECritical 9.8
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021An issue was discovered in Craft CMS before 3.6.0.CVE-2021-27902 · Other software · Craftcms · reported by MITREMedium 6.1
An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2021Craft CMS before 3.6.13 has an XSS vulnerability.CVE-2021-32470 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 3.6.13 has an XSS vulnerability.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2021Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.CVE-2020-19626 · Other software · Craftcms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmayoterry.comgithub.com
Mar 4, 2020The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.CVE-2020-9757 · Other software · Craftcms · reported by MITRECritical 9.8
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2019In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.CVE-2019-9554 · Other software · Craftcms · reported by MITREMedium 6.1
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Oct 24, 2019In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute forceCVE-2019-15929 · Other software · Craftcms · reported by MITRECritical 9.8
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 10, 2019Craft CMS before 3.3.8 has stored XSS via a name field.CVE-2019-17496 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2019In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentiallCVE-2019-14280 · Other software · Craftcms · reported by MITREMedium 5.3
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 18, 2019Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.CVE-2019-12823 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2018Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% stCVE-2018-20465 · Other software · Craftcms · reported by MITREHigh 7.2
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2018index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.CVE-2018-20418 · Other software · Craftcms · reported by MITREMedium 4.8
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2018Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because thCVE-2018-3814 · Other software · Craftcms · reported by MITREHigh 8.8
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2017Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.CVE-2017-9516 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.compacketstormsecurity.com
May 1, 2017Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.CVE-2017-8385 · Other software · Craftcms · reported by MITREMedium 5.3
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
May 1, 2017Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based.CVE-2017-8384 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
May 1, 2017Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.CVE-2017-8383 · Other software · Craftcms · reported by MITREMedium 5.3
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
Apr 21, 2017Craft CMS before 2.6.2974 allows XSS attacks.CVE-2017-8052 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 2.6.2974 allows XSS attacks.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.