Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
180 results · page 4 of 4
Apr 3, 2022Craft CMS before 3.7.29 allows XSS.CVE-2022-28378 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 3.7.29 allows XSS.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.CVE-2022-23409 · Other software · Ethercreative · reported by MITREMedium 4.9
The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.
- Product
- Logs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.complugins.craftcms.com
Sep 29, 2021Craft CMS before 3.7.14 allows CSV injection.CVE-2021-41824 · Other software · Craftcms · reported by MITREHigh 8.8
Craft CMS before 3.7.14 allows CSV injection.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021An issue was discovered in Craft CMS before 3.6.7.CVE-2021-27903 · Other software · Craftcms · reported by MITRECritical 9.8
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021An issue was discovered in Craft CMS before 3.6.0.CVE-2021-27902 · Other software · Craftcms · reported by MITREMedium 6.1
An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2021Craft CMS before 3.6.13 has an XSS vulnerability.CVE-2021-32470 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 3.6.13 has an XSS vulnerability.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2021Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.CVE-2020-19626 · Other software · Craftcms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmayoterry.comgithub.com
Jun 5, 2020An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS.CVE-2020-13870 · Other software · Verbb · reported by MITREMedium 5.4
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.
- Product
- Comments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2020An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS.CVE-2020-13869 · Other software · Verbb · reported by MITREMedium 5.4
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.
- Product
- Comments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2020An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS.CVE-2020-13868 · Other software · Verbb · reported by MITREMedium 6.5
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.
- Product
- Comments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2020The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.CVE-2020-13486 · Other software · Verbb · reported by MITREMedium 6.1
The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.
- Product
- Knock Knock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2020The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.CVE-2020-13485 · Other software · Verbb · reported by MITRECritical 9.1
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
- Product
- Knock Knock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlimpidsecurity.pl
May 25, 2020An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS.CVE-2020-13459 · Other software · Verbb · reported by MITREMedium 5.4
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.
- Product
- Image Resizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2020An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS.CVE-2020-13458 · Other software · Verbb · reported by MITREHigh 8.8
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.
- Product
- Image Resizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2020In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL.CVE-2020-12790 · Other software · Nystudio107 · reported by MITREHigh 7.5
In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2020The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.CVE-2020-9757 · Other software · Craftcms · reported by MITRECritical 9.8
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2019In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.CVE-2019-9554 · Other software · Craftcms · reported by MITREMedium 6.1
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Oct 24, 2019In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute forceCVE-2019-15929 · Other software · Craftcms · reported by MITRECritical 9.8
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 10, 2019Craft CMS before 3.3.8 has stored XSS via a name field.CVE-2019-17496 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2019In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentiallCVE-2019-14280 · Other software · Craftcms · reported by MITREMedium 5.3
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 18, 2019Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.CVE-2019-12823 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2018Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% stCVE-2018-20465 · Other software · Craftcms · reported by MITREHigh 7.2
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2018index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.CVE-2018-20418 · Other software · Craftcms · reported by MITREMedium 4.8
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2018A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorreCVE-2018-14716 · Other software · Nystudio107 · reported by MITREHigh 7.5
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordha.cker.infogithub.com
Jan 1, 2018Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because thCVE-2018-3814 · Other software · Craftcms · reported by MITREHigh 8.8
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2017Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.CVE-2017-9516 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.compacketstormsecurity.com
May 1, 2017Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.CVE-2017-8385 · Other software · Craftcms · reported by MITREMedium 5.3
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
May 1, 2017Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based.CVE-2017-8384 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
May 1, 2017Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.CVE-2017-8383 · Other software · Craftcms · reported by MITREMedium 5.3
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
Apr 21, 2017Craft CMS before 2.6.2974 allows XSS attacks.CVE-2017-8052 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 2.6.2974 allows XSS attacks.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.