CVE-2023-27474 | High | 8.0 | 2023-03-06 | Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL are vulnerable to an HTML injec… |
CVE-2022-23080 | Medium | 5.0 | 2022-06-22 | In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low priv… |
CVE-2022-24814 | High | 8.8 | 2022-04-04 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by insert… |
CVE-2022-22117 | Medium | 5.4 | 2022-01-10 | In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Sc… |
CVE-2022-22116 | Medium | 5.4 | 2022-01-10 | In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functio… |
CVE-2021-29641 | High | 8.8 | 2021-04-07 | Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file t… |
CVE-2021-27583 | Medium | 5.3 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password reset feature. NOTE: This vulnerability… |
CVE-2021-26595 | Medium | 5.3 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of th… |
CVE-2021-26594 | High | 8.8 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end. NOTE: This vulnerab… |
CVE-2021-26593 | High | 7.5 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of information abo… |
CVE-2019-13984 | High | 8.8 | 2019-07-19 | Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, acce… |
CVE-2019-13983 | Critical | 9.8 | 2019-07-19 | Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth… |
CVE-2019-13982 | Medium | 5.3 | 2019-07-19 | interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview. |
CVE-2019-13981 | Medium | 5.3 | 2019-07-19 | In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is re… |
CVE-2019-13980 | High | 8.8 | 2019-07-19 | In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals remote code executi… |
CVE-2019-13979 | High | 8.8 | 2019-07-19 | In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution. |
CVE-2018-10723 | Critical | 9.8 | 2018-05-05 | Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql. |