Craftcms vulnerabilities, page 3
197 vulnerabilities
Known vulnerabilities in Craftcms products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.
CVE-2022-29933craftcmscraft_cms
EPSS score4.58%
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).CVE-2022-28378craftcmscraft_cmsEPSS score0.63%
Craft CMS before 3.7.29 allows XSS.CVE-2017-9516craftcmscraft_cmsEPSS score2.80%
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.CVE-2017-8052craftcmscraft_cmsEPSS score0.83%
Craft CMS before 2.6.2974 allows XSS attacks.CVE-2017-8383craftcmscraft_cmsEPSS score1.15%
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.CVE-2017-8384craftcmscraft_cmsEPSS score0.84%
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.CVE-2017-8385craftcmscraft_cmsEPSS score0.96%
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.CVE-2024-21622craftcmscms+1EPSS score0.59%
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.CVE-2024-52291craftcmscms+1EPSS score1.18%
Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled. This is fixed in 5.4.6 and 4.12.5.CVE-2024-52293craftcmscms+1EPSS score1.36%
Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.CVE-2024-52292craftcmscms+1EPSS score0.75%
Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. This is fixed in 5.4.9 and 4.12.8.CVE-2024-41800craftcmscms+1EPSS score0.46%
Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.CVE-2024-37843craftcmscraft_cmsEPSS score53.24%
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.CVE-2024-56145craftcmscms+1KEVEPSS score97.41%
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.CVE-2024-45406craftcmscms+1EPSS score0.35%
Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.CVE-2019-9554craftcmscraft_cmsEPSS score3.71%
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.CVE-2019-14280craftcmscraft_cmsEPSS score9.36%
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.CVE-2019-17496craftcmscraft_cmsEPSS score0.84%
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.CVE-2019-15929craftcmscraft_cmsEPSS score1.75%
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.CVE-2019-12823craftcmscraft_cmsEPSS score0.94%
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.