Filtered by vendor Craftcms
Subscriptions
Filtered by product Craft Cms
Subscriptions
Total
52 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-33495 | 1 Craftcms | 1 Craft Cms | 2024-12-09 | 6.1 Medium |
| Craft CMS through 4.4.9 is vulnerable to HTML Injection. | ||||
| CVE-2024-41800 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 4.8 Medium |
| Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3. | ||||
| CVE-2024-37843 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 7.5 High |
| Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. | ||||
| CVE-2023-40035 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 7.2 High |
| Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15. | ||||
| CVE-2023-36260 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 7.5 High |
| An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security." | ||||
| CVE-2023-36259 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 5.4 Medium |
| Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation. | ||||
| CVE-2022-37783 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 7.5 High |
| All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework. | ||||
| CVE-2022-37251 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 5.4 Medium |
| Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts. | ||||
| CVE-2022-37250 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 5.4 Medium |
| Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount. | ||||
| CVE-2022-37248 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 5.4 Medium |
| Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php. | ||||
| CVE-2022-37247 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 5.4 Medium |
| Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page. | ||||
| CVE-2022-37246 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 5.4 Medium |
| Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label. | ||||
| CVE-2022-29933 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 8.8 High |
| Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration). | ||||
| CVE-2022-28378 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 6.1 Medium |
| Craft CMS before 3.7.29 allows XSS. | ||||
| CVE-2021-41824 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 8.8 High |
| Craft CMS before 3.7.14 allows CSV injection. | ||||
| CVE-2021-32470 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 6.1 Medium |
| Craft CMS before 3.6.13 has an XSS vulnerability. | ||||
| CVE-2021-27903 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 9.8 Critical |
| An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session). | ||||
| CVE-2021-27902 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads. | ||||
| CVE-2020-9757 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 9.8 Critical |
| The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller. | ||||
| CVE-2020-19626 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 5.4 Medium |
| Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new. | ||||