Craftcms
Page 2 of 2 — Craftcms CVEs from a corpus of 183, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27127 | Medium | 6.3 | 2026-02-24 | Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asse… |
CVE-2026-27126 | Medium | 4.8 | 2026-02-24 | Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerabili… |
CVE-2026-25498 | High | 7.2 | 2026-02-09 | Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnera… |
CVE-2026-25497 | High | 8.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, there is a Privilege Escalatio… |
CVE-2026-25496 | Medium | 4.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exis… |
CVE-2026-25495 | High | 8.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-element… |
CVE-2026-25494 | Medium | 6.5 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation… |
CVE-2026-25493 | Medium | 6.5 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation… |
CVE-2026-25492 | Medium | 6.5 | 2026-02-09 | Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be a… |
CVE-2026-25491 | Medium | 4.8 | 2026-02-09 | Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when dis… |
CVE-2020-37071 | Critical | 9.8 | 2026-02-03 | CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted pa… |
CVE-2026-25522 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25490 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25489 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25488 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25487 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25486 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute ma… |
CVE-2026-25485 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25484 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type nam… |
CVE-2026-25483 | Medium | 5.4 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft… |
CVE-2026-25482 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in t… |
CVE-2025-68456 | Critical | 9.1 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger databa… |
CVE-2025-68455 | High | 7.2 | 2026-01-05 | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated… |
CVE-2025-68454 | High | 8.8 | 2026-01-05 | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated… |
CVE-2025-68437 | Medium | 6.8 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save_<VolumeNa… |
CVE-2025-68436 | Medium | 6.5 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft instal… |
CVE-2025-57811 | High | 7.2 | 2025-08-25 | Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vuln… |
CVE-2025-54417 | High | 8.8 | 2025-08-09 | Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-2… |
CVE-2025-35939 | Medium | 5.3 | 2025-05-07 | Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independe… |
CVE-2025-46731 | High | 7.2 | 2025-05-05 | Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remot… |
CVE-2025-32432 | Critical | 10.0 | 2025-04-25 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-R… |
CVE-2025-23209 | High | 8.0 | 2025-01-18 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that… |
CVE-2024-56145 | Critical | 9.8 | 2024-12-18 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerabi… |
CVE-2024-52292 | High | 7.7 | 2024-11-13 | Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This f… |
CVE-2024-52291 | High | 8.4 | 2024-11-13 | Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file://… |
CVE-2024-52293 | High | 7.2 | 2024-11-13 | Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Re… |
CVE-2024-45406 | Medium | 5.5 | 2024-09-09 | Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input. |
CVE-2024-41800 | Medium | 4.8 | 2024-07-25 | Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit… |
CVE-2024-37843 | Critical | 9.8 | 2024-06-25 | Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. |
CVE-2023-36260 | High | 7.5 | 2024-01-30 | An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me… |
CVE-2023-36259 | Medium | 5.4 | 2024-01-30 | Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation. |
CVE-2024-21622 | Medium | 5.4 | 2024-01-03 | Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to… |
CVE-2023-41892 | Critical | 10.0 | 2023-09-13 | Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15… |
CVE-2023-40035 | High | 7.2 | 2023-08-23 | Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution… |
CVE-2023-33495 | Medium | 6.1 | 2023-06-20 | Craft CMS through 4.4.9 is vulnerable to HTML Injection. |
CVE-2023-30179 | High | 7.2 | 2023-06-13 | CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field… |
CVE-2023-33195 | Medium | 5.0 | 2023-05-27 | Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6. |
CVE-2023-33196 | Medium | 5.5 | 2023-05-26 | Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4… |
CVE-2023-33194 | Low | 3.7 | 2023-05-26 | Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message… |
CVE-2023-33197 | Medium | 5.5 | 2023-05-26 | Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue h… |
CVE-2023-2817 | Medium | 5.4 | 2023-05-26 | A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field… |
CVE-2023-32679 | High | 7.2 | 2023-05-19 | Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If t… |
CVE-2023-30130 | High | 8.8 | 2023-05-12 | An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. |
CVE-2023-31144 | Medium | 6.1 | 2023-05-09 | Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a c… |
CVE-2023-30177 | Medium | 6.1 | 2023-04-25 | CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name. |
CVE-2023-23927 | Medium | 6.1 | 2023-03-03 | Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (X… |
CVE-2022-37783 | High | 7.5 | 2022-12-05 | All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens… |
CVE-2022-37246 | Medium | 5.4 | 2022-09-21 | Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: e… |
CVE-2022-37251 | Medium | 5.4 | 2022-09-16 | Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts. |
CVE-2022-37247 | Medium | 5.4 | 2022-09-16 | Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page. |
CVE-2022-37248 | Medium | 5.4 | 2022-09-16 | Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php. |
CVE-2022-37250 | Medium | 5.4 | 2022-09-16 | Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount. |
CVE-2022-29933 | High | 8.8 | 2022-05-09 | Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the acc… |
CVE-2022-28378 | Medium | 6.1 | 2022-04-03 | Craft CMS before 3.7.29 allows XSS. |
CVE-2021-41824 | High | 8.8 | 2021-09-30 | Craft CMS before 3.7.14 allows CSV injection. |
CVE-2021-27903 | Critical | 9.8 | 2021-06-30 | An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restric… |
CVE-2021-27902 | Medium | 6.1 | 2021-06-30 | An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepte… |
CVE-2021-32470 | Medium | 6.1 | 2021-05-07 | Craft CMS before 3.6.13 has an XSS vulnerability. |
CVE-2020-19626 | Medium | 5.4 | 2021-03-26 | Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new. |
CVE-2020-9757 | Critical | 9.8 | 2020-03-04 | The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller. |
CVE-2019-9554 | Medium | 6.1 | 2019-12-31 | In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI. |
CVE-2019-15929 | Critical | 9.8 | 2019-10-24 | In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute forc… |
CVE-2019-17496 | Medium | 6.1 | 2019-10-11 | Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion. |
CVE-2019-14280 | Medium | 5.3 | 2019-07-26 | In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potential… |
CVE-2019-12823 | Medium | 6.1 | 2019-06-18 | Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. |
CVE-2018-20465 | High | 7.2 | 2018-12-25 | Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% s… |
CVE-2018-20418 | Medium | 4.8 | 2018-12-24 | index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab. |
CVE-2018-3814 | High | 8.8 | 2018-01-01 | Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because t… |
CVE-2017-9516 | Medium | 5.4 | 2017-06-08 | Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file. |
CVE-2017-8385 | Medium | 5.3 | 2017-05-01 | Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message. |
CVE-2017-8384 | Medium | 6.1 | 2017-05-01 | Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOT… |
CVE-2017-8383 | Medium | 5.3 | 2017-05-01 | Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder. |
CVE-2017-8052 | Medium | 6.1 | 2017-04-22 | Craft CMS before 2.6.2974 allows XSS attacks. |