craftcms/cms (Packagist)
Advisories
229
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.10.8 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require craftcms/cms:^5.10.8Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-cc2g-26rw-g997 Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables Withdrawn |
Medium | >= 4.0.0-RC1 | No fix yet |
| GHSA-h784-hpjp-2rrm Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape Withdrawn |
High | >= 4.0.0-RC1 | No fix yet |
| GHSA-4hc4-qjfx-wjf3 Duplicate Advisory: Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element Withdrawn |
Medium | >= 5.0.0-RC1 | No fix yet |
| GHSA-9w6w-8x3c-hfqp Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path traversal Withdrawn |
Medium | >= 4.0.0-RC1 | No fix yet |
| GHSA-w36c-qxrq-v7fw Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass Withdrawn |
High | >= 4.0.0-RC1 | No fix yet |
| GHSA-2p2v-3mjg-gfpf Duplicate Advisory: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts Withdrawn |
Medium | >= 4.0.0-RC1 | No fix yet |
| GHSA-wg23-69c2-gjc8 Craft CMS: Passkey login accepts replayed WebAuthn assertions |
Medium EPSS 0.39% |
>= 5.0.0-RC1, < 5.10.5 | 5.10.5 |
| GHSA-957r-qf9p-67xw Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts |
Medium EPSS 0.38% |
>= 5.0.0-RC1, < 5.10.6 | 5.10.6 |
| GHSA-957r-qf9p-67xw Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts |
Medium EPSS 0.38% |
>= 4.0.0-RC1, < 4.18.2 | 4.18.2 |
| GHSA-596p-6jv8-775v Craft CMS: Authenticated leak of secret environment variables |
Medium EPSS 0.39% |
>= 4.0.0-RC1, < 4.18.2 | 4.18.2 |
| GHSA-596p-6jv8-775v Craft CMS: Authenticated leak of secret environment variables |
Medium EPSS 0.39% |
>= 5.0.0-RC1, < 5.10.6 | 5.10.6 |
| GHSA-xxpx-f366-4xpq Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element |
Medium EPSS 0.27% |
>= 5.0.0-RC1, < 5.10.6 | 5.10.6 |
| GHSA-7hxc-f267-h5q7 Craft CMS: Incorrect path validation could potentially lead to path traversal |
Medium EPSS 0.20% |
>= 4.0.0-RC1, < 4.18.2 | 4.18.2 |
| GHSA-7hxc-f267-h5q7 Craft CMS: Incorrect path validation could potentially lead to path traversal |
Medium EPSS 0.20% |
>= 5.0.0-RC1, < 5.10.6 | 5.10.6 |
| GHSA-2rp4-x2j7-qmcc Craft CMS: Stored XSS in the control panel via unescaped draft name |
Medium EPSS 0.26% |
>= 5.0.0-RC1, < 5.10.8 | 5.10.8 |
| GHSA-p8x7-9vfw-p7vc Craft CMS: Arbitrary user password reset leading to administrator account takeover |
High EPSS 0.46% |
>= 5.0.0-RC1, < 5.10.8 | 5.10.8 |
| GHSA-f5wm-88jv-g5hx Craft CMS: Authenticated RCE through Twig sandbox escape |
High EPSS 0.79% |
>= 5.0.0-RC1, < 5.10.7 | 5.10.7 |
| GHSA-f5wm-88jv-g5hx Craft CMS: Authenticated RCE through Twig sandbox escape |
High EPSS 0.79% |
>= 4.0.0-RC1, < 4.18.3 | 4.18.3 |
| GHSA-265m-7826-wjqm Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass |
High EPSS 0.80% |
>= 4.0.0-RC1, < 4.18.2 | 4.18.2 |
| GHSA-265m-7826-wjqm Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass |
High EPSS 0.80% |
>= 5.0.0-RC1, < 5.10.6 | 5.10.6 |
| GHSA-rqjw-r5g4-x8qm Duplicate Advisory: Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets Withdrawn |
Medium | >= 4.0.0-RC1 | No fix yet |
| GHSA-rmj4-m9cp-mp9v Duplicate Advisory: Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics Withdrawn |
Medium | >= 4.0.0-RC1 | No fix yet |
| GHSA-rmj4-m9cp-mp9v Duplicate Advisory: Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics Withdrawn |
Medium | >= 5.0.0-RC1 | No fix yet |
| GHSA-rvmm-v933-jgxq Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics |
Medium EPSS 0.39% |
>= 5.0.0-RC1, < 5.10.3 | 5.10.3 |
| GHSA-rvmm-v933-jgxq Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics |
Medium EPSS 0.39% |
>= 4.0.0-RC1, < 4.18.1 | 4.18.1 |
| GHSA-9p7c-v5x3-rfx8 Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets |
Medium EPSS 0.39% |
>= 4.0.0-RC1, < 4.18.1 | 4.18.1 |
| GHSA-9p7c-v5x3-rfx8 Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets |
Medium EPSS 0.39% |
>= 5.0.0-RC1, < 5.10.3 | 5.10.3 |
| GHSA-3w32-23wj-rxg3 Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves |
High EPSS 0.35% |
>= 4.0.0-RC1, < 4.17.14 | 4.17.14 |
| GHSA-3w32-23wj-rxg3 Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves |
High EPSS 0.35% |
>= 5.0.0-RC1, < 5.9.21 | 5.9.21 |
| GHSA-x5m4-g2cq-52pq Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements |
High EPSS 0.43% |
>= 5.7.0, < 5.9.21 | 5.9.21 |
| GHSA-f74w-488g-8x5r Craft CMS: Potential authenticated Remote Code Execution via referrer redirect |
High EPSS 0.41% |
>= 5.9.0, < 5.10.0 | 5.10.0 |
| GHSA-287w-mxq6-x2cp Craft CMS: Sensitive File Disclosure / Server-Side File Read |
Medium EPSS 0.33% |
>= 5.0.0-RC1, < 5.10.0 | 5.10.0 |
| GHSA-287w-mxq6-x2cp Craft CMS: Sensitive File Disclosure / Server-Side File Read |
Medium EPSS 0.33% |
>= 4.0.0-RC1, < 4.18.0 | 4.18.0 |
| GHSA-43cq-c2gq-pfpw Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check |
Medium EPSS 0.40% |
>= 5.0.0-RC1, < 5.9.21 | 5.9.21 |
| GHSA-qq2c-2q8j-jh27 Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap |
High EPSS 0.36% |
>= 5.0.0-RC1, < 5.9.21 | 5.9.21 |
| GHSA-24x4-j6x9-rfw5 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget |
High EPSS 0.46% |
>= 5.0.0-RC1, < 5.9.23 | 5.9.23 |
| GHSA-24x4-j6x9-rfw5 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget |
High EPSS 0.46% |
>= 4.0.0-RC1, < 4.17.16 | 4.17.16 |
| GHSA-7h62-6v23-v8fm Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets |
High EPSS 0.39% |
>= 5.0.0-RC1, < 5.9.22 | 5.9.22 |
| GHSA-7h62-6v23-v8fm Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets |
High EPSS 0.39% |
>= 4.0.0-RC1, < 4.17.15 | 4.17.15 |
| GHSA-qh45-9g5p-m2v4 Craft CMS: Unauthorized Deletion of Source Assets During File Replacement |
Medium EPSS 0.36% |
>= 5.0.0-RC1, < 5.9.21 | 5.9.21 |
| GHSA-qh45-9g5p-m2v4 Craft CMS: Unauthorized Deletion of Source Assets During File Replacement |
Medium EPSS 0.36% |
>= 4.0.0-RC1, < 4.17.14 | 4.17.14 |
| GHSA-xrqc-p465-2xvg Craft CMS: Stored XSS via Structure entry title in table view |
Medium EPSS 0.32% |
>= 5.0.0-RC1, < 5.9.53 | 5.9.53 |
| GHSA-f95g-vm94-46c3 Duplicate Advisory: Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options Withdrawn |
Medium | >= 5.0.0-RC1 | No fix yet |
| GHSA-jcmp-jxh2-4jc3 Duplicate Advisory: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read Withdrawn |
Medium | >= 4.0.0-RC1, <= 4.17.6 | No fix yet |
| GHSA-5w9j-w5p8-r4p7 Duplicate Advisory: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type Withdrawn |
Medium | >= 4.5.0-beta.1, <= 4.16.18 | No fix yet |
| GHSA-xj2c-g5xp-4p47 Duplicate Advisory: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission Withdrawn |
Medium | >= 4.0.0-RC1, <= 4.17.7 | No fix yet |
| GHSA-f4h3-qhg5-j6mq Duplicate Advisory: Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata Withdrawn |
Medium | >= 5.0.0-RC1, <= 5.9.13 | No fix yet |
| GHSA-pmm4-v8f6-4vpp Duplicate Advisory: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview Withdrawn |
High | >= 5.5.0, <= 5.9.13 | No fix yet |
| GHSA-9r7j-7jhg-4f4c Duplicate Advisory: Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page Withdrawn |
Medium | >= 5.0.0-RC1, <= 5.8.21 | No fix yet |
| GHSA-c43v-4cr8-6mvp Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read |
Medium EPSS 0.49% |
>= 4.0.0-RC1, < 4.17.7 | 4.17.7 |
| GHSA-c43v-4cr8-6mvp Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read |
Medium EPSS 0.49% |
>= 5.0.0-RC1, < 5.9.13 | 5.9.13 |
| GHSA-x76w-8c62-48mg Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission |
Medium EPSS 0.33% |
>= 4.0.0-RC1, < 4.17.8 | 4.17.8 |
| GHSA-x76w-8c62-48mg Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission |
Medium EPSS 0.33% |
>= 5.0.0-RC1, < 5.9.14 | 5.9.14 |
| GHSA-86vw-x4ww-x467 Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview |
High EPSS 0.68% |
>= 5.5.0, < 5.9.14 | 5.9.14 |
| GHSA-c55v-343g-5xff Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs |
Critical EPSS 0.46% |
>= 5.0.0-RC1, < 5.10 | 5.10 |
| GHSA-c55v-343g-5xff Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs |
Critical EPSS 0.46% |
>= 4.0.0-RC1, < 4.18 | 4.18 |
| GHSA-33m5-hqp9-97pw Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure |
High EPSS 0.34% |
>= 5.0.0-RC1, < 5.9.18 | 5.9.18 |
| GHSA-qrgm-p9w5-rrfw Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior |
High EPSS 0.62% |
>= 4.0.0, < 4.17.12 | 4.17.12 |
| GHSA-qrgm-p9w5-rrfw Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior |
High EPSS 0.62% |
>= 5.0.0, < 5.9.18 | 5.9.18 |
| GHSA-gj2p-p9m4-c8gw Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure |
High EPSS 0.41% |
>= 5.0.0, < 5.9.18 | 5.9.18 |
| GHSA-gj2p-p9m4-c8gw Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure |
High EPSS 0.41% |
>= 4.0.0, < 4.17.12 | 4.17.12 |
| GHSA-95wr-3f2v-v2wh Craft CMS has a host header injection leading to SSRF via resource-js endpoint |
Medium EPSS 0.33% |
>= 4.0.0-RC1, < 4.17.9 | 4.17.9 |
| GHSA-95wr-3f2v-v2wh Craft CMS has a host header injection leading to SSRF via resource-js endpoint |
Medium EPSS 0.33% |
>= 5.0.0-RC1, < 5.9.15 | 5.9.15 |
| GHSA-3m9m-24vh-39wx Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations |
Medium EPSS 0.27% |
>= 4.0.0-RC1, < 4.17.9 | 4.17.9 |
| GHSA-3m9m-24vh-39wx Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations |
Medium EPSS 0.27% |
>= 5.0.0-RC1, < 5.9.15 | 5.9.15 |
| GHSA-jq2f-59pj-p3m3 Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action |
Medium EPSS 0.25% |
>= 5.6.0, < 5.9.15 | 5.9.15 |
| GHSA-44px-qjjc-xrhq Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata |
Medium EPSS 0.36% |
>= 4.0.0-RC1, < 4.17.8 | 4.17.8 |
| GHSA-44px-qjjc-xrhq Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata |
Medium EPSS 0.36% |
>= 5.0.0-RC1, < 5.9.14 | 5.9.14 |
| GHSA-f582-6gf6-gx4g Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions |
Medium EPSS 0.29% |
>= 5.3.0, < 5.9.14 | 5.9.14 |
| GHSA-vgjg-248p-rfm2 Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users |
Medium EPSS 0.22% |
>= 4.0.0-RC1, < 4.17.8 | 4.17.8 |
| GHSA-vgjg-248p-rfm2 Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users |
Medium EPSS 0.22% |
>= 5.0.0-RC1, < 5.9.14 | 5.9.14 |
| GHSA-5pgf-h923-m958 Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL |
Medium EPSS 0.36% |
>= 5.0.0-RC1, < 5.9.14 | 5.9.14 |
| GHSA-5pgf-h923-m958 Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL |
Medium EPSS 0.36% |
>= 4.0.0-RC1, < 4.17.8 | 4.17.8 |
| GHSA-6mrr-q3pj-h53w Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations |
Medium EPSS 0.31% |
>= 4.0.0-RC1, < 4.17.8 | 4.17.8 |
| GHSA-6mrr-q3pj-h53w Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations |
Medium EPSS 0.31% |
>= 5.0.0-RC1, < 5.9.14 | 5.9.14 |
| GHSA-3pvf-vxrv-hh9c Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) |
Medium EPSS 0.36% |
>= 5.0.0-RC1, < 5.9.14 | 5.9.14 |
| GHSA-3pvf-vxrv-hh9c Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) |
Medium EPSS 0.36% |
>= 4.0.0-RC1, < 4.17.8 | 4.17.8 |
| GHSA-2fph-6v5w-89hh Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior |
High EPSS 1.11% |
>= 5.6.0, < 5.9.13 | 5.9.13 |
| GHSA-3x4w-mxpf-fhqq Craft CMS Vulnerable to Stored XSS in Revision Context Menu |
Medium EPSS 0.25% |
>= 5.9.0-beta.1, < 5.9.11 | 5.9.11 |
| GHSA-cc7p-2j3x-x7xf Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() |
Critical EPSS 9.36% |
>= 5.0.0-RC1, < 5.9.12 | 5.9.12 |
| GHSA-cc7p-2j3x-x7xf Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() |
Critical EPSS 9.36% |
>= 4.0.0-RC1, < 4.17.6 | 4.17.6 |
| GHSA-4484-8v2f-5748 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController |
High EPSS 0.53% |
>= 4.0.0-RC1, < 4.17.5 | 4.17.5 |
| GHSA-4484-8v2f-5748 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController |
High EPSS 0.53% |
>= 5.0.0-RC1, < 5.9.11 | 5.9.11 |
| GHSA-qx2q-q59v-wf3j Craft CMS vulnerable to behavior injection RCE via EntryTypesController |
High EPSS 0.52% |
>= 5.6.0, < 5.9.11 | 5.9.11 |
| GHSA-472v-j2g4-g9h2 Craft CMS has a Path Traversal Vulnerability in AssetsController |
Medium EPSS 0.30% |
>= 5.0.0-RC1, < 5.9.11 | 5.9.11 |
| GHSA-472v-j2g4-g9h2 Craft CMS has a Path Traversal Vulnerability in AssetsController |
Medium EPSS 0.30% |
>= 4.0.0-RC1, < 4.17.5 | 4.17.5 |
| GHSA-g3hp-vvqf-8vw6 Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page |
Medium EPSS 0.18% |
>= 5.0.0-RC1, < 5.8.22 | 5.8.22 |
| GHSA-fp5j-j7j4-mcxc CraftCMS has an RCE vulnerability via relational conditionals in the control panel |
High EPSS 0.86% |
>= 4.0.0-beta.1, < 4.17.4 | 4.17.4 |
| GHSA-fp5j-j7j4-mcxc CraftCMS has an RCE vulnerability via relational conditionals in the control panel |
High EPSS 0.86% |
>= 5.0.0-RC1, < 5.9.9 | 5.9.9 |
| GHSA-g7j6-fmwx-7vp8 CraftCMS's `ElementSearchController` Affected by Blind SQL Injection |
High EPSS 0.36% |
>= 5.0.0-RC1, < 5.9.9 | 5.9.9 |
| GHSA-fvwq-45qv-xvhv CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization |
Medium EPSS 0.19% |
>= 4.15.3, < 4.17.3 | 4.17.3 |
| GHSA-fvwq-45qv-xvhv CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization |
Medium EPSS 0.19% |
>= 5.7.5, < 5.9.7 | 5.9.7 |
| GHSA-vg3j-hpm9-8v5v Craft CMS has a potential information disclosure vulnerability in preview tokens |
Medium EPSS 0.18% |
>= 5.0.0-RC1, < 5.9.7 | 5.9.7 |
| GHSA-vg3j-hpm9-8v5v Craft CMS has a potential information disclosure vulnerability in preview tokens |
Medium EPSS 0.18% |
>= 4.0.0-RC1, < 4.17.3 | 4.17.3 |
| GHSA-234q-vvw3-mrfq Craft CMS has unauthenticated activation email trigger with potential user enumeration |
Medium EPSS 0.32% |
>= 5.0.0-RC1, < 5.9.0-beta.2 | 5.9.0-beta.2 |
| GHSA-234q-vvw3-mrfq Craft CMS has unauthenticated activation email trigger with potential user enumeration |
Medium EPSS 0.32% |
>= 4.0.0-RC1, < 4.17.0-beta.2 | 4.17.0-beta.2 |
| GHSA-qc86-q28f-ggww Craft CMS has potential authenticated Remote Code Execution via Twig SSTI |
High EPSS 0.59% |
>= 4.0.0-RC1, < 4.17.0-beta.1 | 4.17.0-beta.1 |
| GHSA-qc86-q28f-ggww Craft CMS has potential authenticated Remote Code Execution via Twig SSTI |
High EPSS 0.59% |
>= 5.0.0-RC1, < 5.9.0-beta.1 | 5.9.0-beta.1 |
| GHSA-jxm3-pmm2-9gf6 Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action |
Medium EPSS 0.27% |
>= 5.0.0-RC1, < 5.9.0-beta.1 | 5.9.0-beta.1 |
| GHSA-jxm3-pmm2-9gf6 Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action |
Medium EPSS 0.27% |
>= 4.0.0-RC1, < 4.17.0-beta.1 | 4.17.0-beta.1 |
| GHSA-5fvc-7894-ghp4 Craft CMS has Twig Function Blocklist Bypass |
Critical EPSS 0.51% |
>= 4.0.0-RC1, < 4.17.0-beta.1 | 4.17.0-beta.1 |
| GHSA-5fvc-7894-ghp4 Craft CMS has Twig Function Blocklist Bypass |
Critical EPSS 0.51% |
>= 5.0.0-RC1, < 5.9.0-beta.1 | 5.9.0-beta.1 |
| GHSA-2xfc-g69j-x2mp Craft CMS: Entries Authorship Spoofing via Mass Assignment |
Medium EPSS 0.39% |
>= 5.0.0-RC1, < 5.9.0-beta.1 | 5.9.0-beta.1 |
| GHSA-2xfc-g69j-x2mp Craft CMS: Entries Authorship Spoofing via Mass Assignment |
Medium EPSS 0.39% |
>= 4.0.0-RC1, < 4.17.0-beta.1 | 4.17.0-beta.1 |
| GHSA-v47q-jxvr-p68x Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates |
Critical EPSS 1.19% |
>= 5.0.0-RC1, < 5.9.0-beta.1 | 5.9.0-beta.1 |
| GHSA-v47q-jxvr-p68x Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates |
Critical EPSS 1.19% |
>= 4.0.0-RC1, < 4.17.0-beta.1 | 4.17.0-beta.1 |
| GHSA-4mgv-366x-qxvx Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options |
Medium EPSS 0.22% |
>= 5.0.0-RC1, < 5.9.0-beta.1 | 5.9.0-beta.1 |
| GHSA-4mgv-366x-qxvx Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options |
Medium EPSS 0.22% |
>= 4.0.0-RC1, < 4.17.0-beta.1 | 4.17.0-beta.1 |
| GHSA-7x43-mpfg-r9wj Craft CMS has IDOR via GraphQL @parseRefs |
High EPSS 0.49% |
>= 5.0.0-RC1, < 5.9.0-beta.1 | 5.9.0-beta.1 |
| GHSA-7x43-mpfg-r9wj Craft CMS has IDOR via GraphQL @parseRefs |
High EPSS 0.49% |
>= 4.0.0-RC1, < 4.17.0-beta.1 | 4.17.0-beta.1 |
| GHSA-94rc-cqvm-m4pw Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget |
High EPSS 0.66% |
>= 5.8.7, < 5.9.0-beta.1 | 5.9.0-beta.1 |
| GHSA-94rc-cqvm-m4pw Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget |
High EPSS 0.66% |
>= 4.0.0-RC1, < 4.17.0-beta.1 | 4.17.0-beta.1 |
| GHSA-6j87-m5qx-9fqp Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type |
Medium EPSS 0.22% |
>= 5.0.0-RC1, < 5.8.23 | 5.8.23 |
| GHSA-6j87-m5qx-9fqp Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type |
Medium EPSS 0.22% |
>= 4.5.0-beta.1, < 4.16.19 | 4.16.19 |
| GHSA-v2gc-rm6g-wrw9 Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution |
Medium EPSS 0.46% |
>= 3.5.0, < 4.16.19 | 4.16.19 |
| GHSA-v2gc-rm6g-wrw9 Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution |
Medium EPSS 0.46% |
>= 5.0.0-RC1, < 5.8.23 | 5.8.23 |
| GHSA-6fx5-5cw5-4897 Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit |
Medium EPSS 0.20% |
>= 5.0.0-RC1, < 5.8.23 | 5.8.23 |
| GHSA-6fx5-5cw5-4897 Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit |
Medium EPSS 0.20% |
>= 4.5.0-RC1, < 4.16.19 | 4.16.19 |
| GHSA-gp2f-7wcm-5fhx Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding |
Medium EPSS 0.49% |
>= 5.0.0-RC1, < 5.8.23 | 5.8.23 |
| GHSA-gp2f-7wcm-5fhx Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding |
Medium EPSS 0.49% |
>= 3.5.0, < 4.16.19 | 4.16.19 |
| GHSA-3jh3-prx3-w6wc Craft CMS has Stored XSS in Table Field via "HTML" Column Type |
Medium EPSS 0.25% |
>= 5.0.0-RC1, < 5.8.23 | 5.8.23 |
| GHSA-3jh3-prx3-w6wc Craft CMS has Stored XSS in Table Field via "HTML" Column Type |
Medium EPSS 0.25% |
>= 4.5.0-RC1, < 4.16.19 | 4.16.19 |
| GHSA-7jx7-3846-m7w7 Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior |
High EPSS 1.12% |
>= 4.0.0-RC1, < 4.16.18 | 4.16.18 |
| GHSA-7jx7-3846-m7w7 Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior |
High EPSS 1.12% |
>= 5.0.0-RC1, < 5.8.22 | 5.8.22 |
| GHSA-fxp3-g6gw-4r4v Craft CMS: GraphQL Asset Mutation Privilege Escalation |
High EPSS 0.48% |
>= 4.0.0-RC1, < 4.17.0-beta.1 | 4.17.0-beta.1 |
| GHSA-fxp3-g6gw-4r4v Craft CMS: GraphQL Asset Mutation Privilege Escalation |
High EPSS 0.48% |
>= 5.0.0-RC1, < 5.9.0-beta.1 | 5.9.0-beta.1 |
| GHSA-9f5h-mmq6-2x78 Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields |
Medium EPSS 0.42% |
>= 5.0.0-RC1, < 5.8.22 | 5.8.22 |
| GHSA-9f5h-mmq6-2x78 Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields |
Medium EPSS 0.42% |
>= 4.0.0-RC1, < 4.16.18 | 4.16.18 |
| GHSA-2453-mppf-46cj Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` |
High EPSS 0.56% |
>= 4.0.0-RC1, < 4.16.18 | 4.16.18 |
| GHSA-2453-mppf-46cj Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` |
High EPSS 0.56% |
>= 5.0.0-RC1, < 5.8.22 | 5.8.22 |
| GHSA-m5r2-8p9x-hp5m Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation |
Medium EPSS 0.40% |
>= 4.0.0-RC1, < 4.16.18 | 4.16.18 |
| GHSA-m5r2-8p9x-hp5m Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation |
Medium EPSS 0.40% |
>= 5.0.0-RC1, < 5.8.22 | 5.8.22 |
| GHSA-8jr8-7hr4-vhfx Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect |
Medium EPSS 0.40% |
>= 5.0.0-RC1, < 5.8.22 | 5.8.22 |
| GHSA-8jr8-7hr4-vhfx Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect |
Medium EPSS 0.40% |
>= 4.0.0-RC1, < 4.16.18 | 4.16.18 |
| GHSA-7pr4-wx9w-mqwr Craft CMS Vulnerable to Stored XSS in Entry Types Name |
Medium EPSS 0.36% |
>= 5.0.0-RC1, < 5.8.22 | 5.8.22 |
| GHSA-255j-qw47-wjh5 Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior |
High EPSS 0.97% |
>= 5.0.0-RC1, < 5.8.21 | 5.8.21 |
| GHSA-255j-qw47-wjh5 Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior |
High EPSS 0.97% |
>= 4.0.0-RC1, < 4.16.17 | 4.16.17 |
| GHSA-v64r-7wg9-23pr Unauthenticated Craft CMS users can trigger a database backup |
Critical EPSS 0.56% |
>= 5.0.0-RC1, < 5.8.21 | 5.8.21 |
| GHSA-v64r-7wg9-23pr Unauthenticated Craft CMS users can trigger a database backup |
Critical EPSS 0.56% |
>= 3.0.0, < 4.16.17 | 4.16.17 |
| GHSA-742x-x762-7383 Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI |
High EPSS 0.94% |
>= 4.0.0-RC1, < 4.16.17 | 4.16.17 |
| GHSA-742x-x762-7383 Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI |
High EPSS 0.94% |
>= 5.0.0-RC1, < 5.8.21 | 5.8.21 |
| GHSA-x27p-wfqw-hfcc Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation |
Medium EPSS 0.49% |
>= 3.5.0, < 4.16.17 | 4.16.17 |
| GHSA-x27p-wfqw-hfcc Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation |
Medium EPSS 0.49% |
>= 5.0.0-RC1, < 5.8.21 | 5.8.21 |
| GHSA-53vf-c43h-j2x9 Craft CMS vulnerable to potential information disclosure via unchecked asset relocation |
Medium EPSS 0.28% |
>= 5.0.0-RC1, < 5.8.21 | 5.8.21 |
| GHSA-53vf-c43h-j2x9 Craft CMS vulnerable to potential information disclosure via unchecked asset relocation |
Medium EPSS 0.28% |
>= 4.0.0-RC1, < 4.16.17 | 4.16.17 |
| GHSA-crcq-738g-pqvc Craft CMS Potential Remote Code Execution via Twig SSTI |
High EPSS 0.94% |
>= 4.0.0-RC1, < 4.16.6 | 4.16.6 |
| GHSA-crcq-738g-pqvc Craft CMS Potential Remote Code Execution via Twig SSTI |
High EPSS 0.94% |
>= 5.0.0-RC1, < 5.8.7 | 5.8.7 |
| GHSA-2vcf-qxv3-2mgw Craft CMS has a theoretical bypass for CVE-2025-23209 |
High EPSS 0.53% |
>= 5.5.8, < 5.8.4 | 5.8.4 |
| GHSA-2vcf-qxv3-2mgw Craft CMS has a theoretical bypass for CVE-2025-23209 |
High EPSS 0.53% |
>= 4.13.8, < 4.16.3 | 4.16.3 |
| GHSA-7vrx-9684-xrf2 Craft CMS stores arbitrary content provided by unauthenticated users in session files Known exploited |
Medium EPSS 1.35% |
< 4.15.3 | 4.15.3 |
| GHSA-7vrx-9684-xrf2 Craft CMS stores arbitrary content provided by unauthenticated users in session files Known exploited |
Medium EPSS 1.35% |
>= 5.0.0-alpha.1, < 5.7.5 | 5.7.5 |
| GHSA-7vrx-9684-xrf2 Craft CMS stores arbitrary content provided by unauthenticated users in session files Known exploited |
Medium EPSS 1.35% |
< 4.15.3 | 4.15.3 |
| GHSA-7vrx-9684-xrf2 Craft CMS stores arbitrary content provided by unauthenticated users in session files Known exploited |
Medium EPSS 1.35% |
>= 5.0.0-alpha.1, < 5.7.5 | 5.7.5 |
| GHSA-7c58-g782-9j38 Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI |
High EPSS 1.52% |
>= 4.0.0-RC1, < 4.14.13 | 4.14.13 |
| GHSA-7c58-g782-9j38 Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI |
High EPSS 1.52% |
>= 5.0.0-RC1, < 5.6.15 | 5.6.15 |
| GHSA-f3gw-9ww9-jmc3 Craft CMS Allows Remote Code Execution Known exploited |
Critical EPSS 99.79% |
>= 3.0.0-RC1, < 3.9.15 | 3.9.15 |
| GHSA-f3gw-9ww9-jmc3 Craft CMS Allows Remote Code Execution Known exploited |
Critical EPSS 99.79% |
>= 5.0.0-RC1, <= 5.6.16 | No fix yet |
| GHSA-f3gw-9ww9-jmc3 Craft CMS Allows Remote Code Execution Known exploited |
Critical EPSS 99.79% |
>= 4.0.0-RC1, <= 4.14.14 | No fix yet |
| GHSA-f3gw-9ww9-jmc3 Craft CMS Allows Remote Code Execution Known exploited |
Critical EPSS 99.79% |
>= 3.0.0-RC1, <= 3.9.14 | No fix yet |
| GHSA-f3gw-9ww9-jmc3 Craft CMS Allows Remote Code Execution Known exploited |
Critical EPSS 99.79% |
>= 5.0.0-RC1, < 5.6.17 | 5.6.17 |
| GHSA-f3gw-9ww9-jmc3 Craft CMS Allows Remote Code Execution Known exploited |
Critical EPSS 99.79% |
>= 4.0.0-RC1, < 4.14.15 | 4.14.15 |
| GHSA-x684-96hh-833x Craft CMS has a potential RCE with a compromised security key Known exploited |
High EPSS 21.64% |
>= 4.0.0-RC1, < 4.13.8 | 4.13.8 |
| GHSA-x684-96hh-833x Craft CMS has a potential RCE with a compromised security key Known exploited |
High EPSS 21.64% |
>= 5.0.0-RC1, < 5.5.8 | 5.5.8 |
| GHSA-x684-96hh-833x Craft CMS has a potential RCE with a compromised security key Known exploited |
High EPSS 21.64% |
>= 4.0.0-RC1, < 4.13.8 | 4.13.8 |
| GHSA-x684-96hh-833x Craft CMS has a potential RCE with a compromised security key Known exploited |
High EPSS 21.64% |
>= 5.0.0-RC1, < 5.5.5 | 5.5.5 |
| GHSA-2p6p-9rc9-62j9 Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled Known exploited |
Critical EPSS 97.48% |
>= 4.0.0-RC1, < 4.13.2 | 4.13.2 |
| GHSA-2p6p-9rc9-62j9 Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled Known exploited |
Critical EPSS 97.48% |
>= 3.0.0, < 3.9.14 | 3.9.14 |
| GHSA-2p6p-9rc9-62j9 Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled Known exploited |
Critical EPSS 97.48% |
>= 4.0.0-RC1, < 4.13.2 | 4.13.2 |
| GHSA-2p6p-9rc9-62j9 Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled Known exploited |
Critical EPSS 97.48% |
>= 5.0.0-RC1, < 5.5.2 | 5.5.2 |
| GHSA-2p6p-9rc9-62j9 Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled Known exploited |
Critical EPSS 97.48% |
>= 5.0.0-RC1, < 5.5.2 | 5.5.2 |
| GHSA-2p6p-9rc9-62j9 Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled Known exploited |
Critical EPSS 97.48% |
>= 3.0.0, < 3.9.14 | 3.9.14 |
| GHSA-f3cw-hg6r-chfv Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI |
High EPSS 1.52% |
>= 5.0.0-RC1, < 5.4.3 | 5.4.3 |
| GHSA-f3cw-hg6r-chfv Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI |
High EPSS 1.52% |
>= 4.0.0-RC1, < 4.12.2 | 4.12.2 |
| GHSA-cw6g-qmjq-6w2w Craft CMS Arbitrary System File Read |
Medium EPSS 0.75% |
>= 3.5.13, < 4.12.8 | 4.12.8 |
| GHSA-cw6g-qmjq-6w2w Craft CMS Arbitrary System File Read |
Medium EPSS 0.75% |
>= 5.0.0-alpha.1, < 5.4.9 | 5.4.9 |
| GHSA-jrh5-vhr9-qh7q Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution |
High EPSS 1.25% |
>= 5.0.0-RC1, < 5.4.6 | 5.4.6 |
| GHSA-jrh5-vhr9-qh7q Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution |
High EPSS 1.25% |
>= 4.0.0-RC1, < 4.12.5 | 4.12.5 |
| GHSA-28h4-788g-rh42 Craft CMS vulnerable to stored XSS in breadcrumb list and title fields |
Medium EPSS 0.35% |
>= 5.0.0, < 5.1.2 | 5.1.2 |
| GHSA-wmx7-pw49-88jx Craft CMS Allows TOTP Token To Stay Valid After Use |
High EPSS 0.46% |
>= 5.0.0-beta.1, < 5.2.3 | 5.2.3 |
| GHSA-hq4f-mv3q-8wcv Craft CMS SQL injection vulnerability via the GraphQL API endpoint |
Critical EPSS 53.24% |
<= 3.7.31 | No fix yet |
| GHSA-6p78-f7h9-6838 Craft CMS Feed-Me |
High EPSS 1.07% |
< 4.6.2 | 4.6.2 |
| GHSA-j5g9-j7r4-6qvx Craft CMS Privilege Escalation |
High EPSS 0.59% |
>= 4.0.0-RC1, < 4.5.11 | 4.5.11 |
| GHSA-j5g9-j7r4-6qvx Craft CMS Privilege Escalation |
High EPSS 0.59% |
>= 3.0.0, < 3.9.6 | 3.9.6 |
| GHSA-4w8r-3xrw-v25g Craft CMS Remote Code Execution vulnerability |
Critical EPSS 94.22% |
>= 4.0.0-RC1, < 4.4.15 | 4.4.15 |
| GHSA-44wr-rmwq-3phw Craft CMS vulnerable to Remote Code Execution via validatePath bypass |
High EPSS 2.32% |
>= 3.0.0, < 3.8.15 | 3.8.15 |
| GHSA-44wr-rmwq-3phw Craft CMS vulnerable to Remote Code Execution via validatePath bypass |
High EPSS 2.32% |
>= 4.0.0-RC1, < 4.4.15 | 4.4.15 |
| GHSA-m3v5-gjj9-rg24 Craft CMS vulnerable to HTML injection |
Medium EPSS 0.50% |
<= 4.4.9 | No fix yet |
| GHSA-3x74-v64j-qc3f Withdrawn Advisory: CraftCMS Server-Side Template Injection vulnerability Withdrawn |
High EPSS 2.20% |
< 4.4.2 | 4.4.2 |
| GHSA-7x94-jx75-3gh6 Stored cross site scripting in Craft CMS |
Medium EPSS 0.44% |
>= 4.0.0-RC1, < 4.4.12 | 4.4.12 |
| GHSA-6qjx-787v-6pxr Craft CMS stored XSS in indexedVolumes |
Medium EPSS 0.68% |
>= 4.0.0-RC1, < 4.4.6 | 4.4.6 |
| GHSA-cjmm-x9x9-m2w5 Craft CMS stored XSS in review volume |
Medium EPSS 0.65% |
>= 4.0.0-RC1, < 4.4.7 | 4.4.7 |
| GHSA-qpgm-gjgf-8c2x Craft CMS XSS in RSS widget feed |
Medium EPSS 0.65% |
>= 4.3.0, < 4.4.6 | 4.4.6 |
| GHSA-3wxg-w96j-8hq9 CraftCMS stored XSS in Quick Post widget error message |
Medium EPSS 0.62% |
>= 4.0.0-RC1, < 4.4.6 | 4.4.6 |
| GHSA-3wxg-w96j-8hq9 CraftCMS stored XSS in Quick Post widget error message |
Medium EPSS 0.62% |
>= 3.0.0, < 3.8.6 | 3.8.6 |
| GHSA-vqxf-r9ph-cc9c Craft CMS vulnerable to Remote Code Execution via unrestricted file extension |
High EPSS 1.85% |
>= 4.0.0, < 4.4.6 | 4.4.6 |
| GHSA-fjx5-xm7q-whvj CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter |
High EPSS 1.42% |
<= 3.8.1 | No fix yet |
| GHSA-j4mx-98hw-6rv6 craftcms/cms vulnerable to cross site scripting in RSS feed widget |
Medium EPSS 0.41% |
>= 3.0.0, < 3.8.4 | 3.8.4 |
| GHSA-j4mx-98hw-6rv6 craftcms/cms vulnerable to cross site scripting in RSS feed widget |
Medium EPSS 0.41% |
>= 4.0.0, < 4.4.4 | 4.4.4 |
| GHSA-wv7j-rc2q-9j67 Cross Site Scripting in CraftCMS |
Medium EPSS 0.40% |
< 3.7.68 | 3.7.68 |
| GHSA-qcrj-6ffc-v7hq Craft CMS Stored Cross-site Scripting Injection Vulnerability |
Medium EPSS 0.80% |
>= 3.7.24, < 3.7.64 | 3.7.64 |
| GHSA-qcrj-6ffc-v7hq Craft CMS Stored Cross-site Scripting Injection Vulnerability |
Medium EPSS 0.80% |
>= 4.0.0-RC1, < 4.3.7 | 4.3.7 |
| GHSA-h972-v458-m892 Craft CMS discloses password hashes |
High EPSS 1.11% |
>= 3.0.0, < 3.7.33 | 3.7.33 |
| GHSA-f546-v666-559x Craft CMS Cross-site Scripting vulnerability |
Medium EPSS 0.52% |
>= 4.0.0-RC1, < 4.2.1 | 4.2.1 |
| GHSA-f546-v666-559x Craft CMS Cross-site Scripting vulnerability |
Medium EPSS 0.52% |
>= 3.7.39, < 3.7.51 | 3.7.51 |
| GHSA-8r89-x93x-mjq2 Craft CMS Stored Cross-site Scripting in User Addresses Title |
Medium EPSS 0.67% |
>= 4.0.0-RC1, < 4.2.1 | 4.2.1 |
| GHSA-wxvf-839f-jqmh Craft CMS Cross site Scripting vulnerability |
Medium EPSS 0.66% |
>= 4.0.0-RC1, < 4.2.1 | 4.2.1 |
| GHSA-mw37-wx8p-gp45 Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts |
Medium EPSS 0.50% |
>= 3.7.0-beta.1, < 3.7.55.2 | 3.7.55.2 |
| GHSA-3cvm-7wrh-qrf9 Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page |
Medium EPSS 0.57% |
>= 4.0.0-RC1, < 4.2.1 | 4.2.1 |
| GHSA-mw37-wx8p-gp45 Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts |
Medium EPSS 0.50% |
>= 4.0.0-RC1, < 4.2.1 | 4.2.1 |
| GHSA-33jj-92px-m4g7 Craft CMS Cross-site Scripting Vulnerability |
Medium EPSS 0.85% |
< 3.1.33 | 3.1.33 |
| GHSA-wvr4-w6cw-4px8 Craft CMS possibility of brute force attempts |
Critical EPSS 1.75% |
< 3.1.7 | 3.1.7 |
| GHSA-f3xr-q258-h7m9 Craft CMS XSS Vulnerability |
Medium EPSS 0.84% |
< 3.3.8 | 3.3.8 |
| GHSA-w5q4-q7wp-qww6 Craft CMS XSS Vulnerability |
Medium EPSS 0.94% |
< 3.1.31 | 3.1.31 |
| GHSA-xv5f-2997-qhrq Craft CMS XSS Vulnerability |
Medium EPSS 0.83% |
< 2.6.2974 | 2.6.2974 |
| GHSA-j27g-r58q-624w Craft CMS subject to URL forgery |
Medium EPSS 0.96% |
< 2.6.2976 | 2.6.2976 |
| GHSA-9mcw-mwxv-grwj Craft CMS XSS Vulnerability |
Medium EPSS 0.84% |
< 2.6.2976 | 2.6.2976 |
| GHSA-6pvw-hh48-jx7p Craft CMS XSS Vulnerability |
Medium EPSS 2.80% |
< 2.6.2982 | 2.6.2982 |
| GHSA-72pf-cvwq-vgqg Craft CMS Cross-site Scripting (XSS) Vulnerability |
Medium EPSS 3.70% |
<= 3.0.25 | No fix yet |
| GHSA-j7fx-v37j-v3w7 Craft CMS Vulnerable to Server-Side Template Injection |
High EPSS 1.53% |
<= 3.0.34 | No fix yet |
| GHSA-7qq6-fgpw-xw45 Craft CMS Unauthorized View |
Medium EPSS 1.15% |
< 2.6.2976 | 2.6.2976 |
| GHSA-r342-vjc4-wrmj Craft CMS PHP Code Injection Vulnerability |
High EPSS 1.88% |
<= 2.6.3000 | No fix yet |
| GHSA-5cjr-78cq-3wrg Improper account password reset in Craft CMS |
High EPSS 4.58% |
< 3.7.36 | 3.7.36 |
| GHSA-wf98-vxv9-jqfv XSS Injection Vulnerability |
Low | < 3.7.29 | 3.7.29 |
| GHSA-7xj5-fwqr-5378 Cross-site Scripting in craftcms/cms |
Medium EPSS 0.63% |
< 3.7.29 | 3.7.29 |
| GHSA-h2rj-8wgg-mm43 Craft CMS Cross-site Scripting Vulnerability |
Medium EPSS 0.73% |
< 3.6.13 | 3.6.13 |
| GHSA-h7vq-5qgw-jwwq CSV Injection Vulnerability |
High EPSS 1.37% |
>= 3.4.0, < 3.7.14 | 3.7.14 |
| GHSA-xrpj-f9v6-2332 CSV injection in Craft CMS Withdrawn |
High | < 3.7.14 | 3.7.14 |
| GHSA-x2j7-6hxm-87p3 Craft CMS Remote Code Injection |
Critical EPSS 2.82% |
< 3.6.7 | 3.6.7 |
| GHSA-3jxh-789f-p7m6 Craft CMS Cross-site Scripting Vulnerability |
Medium EPSS 0.99% |
< 3.6.0 | 3.6.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor