Craft CMS craftcms Craft CMS

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.

Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI

Craft Potential Remote Code Execution via Twig SSTI

Craft Affected by Entries Authorship Spoofing via Mass Assignment

Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding

Craft CMS stores user-provided content in session files

Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect

Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation

Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users

Craft has an unauthenticated activation email trigger with potential user enumeration

Craft has Reflective XSS via incomplete return URL sanitization

Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit

Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation

Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Cloud Metadata SSRF Protection Bypass via IPv6 Resolution

Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions

Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.

Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.

Craft CMS before 2.6.2974 allows XSS attacks.

Craft CMS stored cross-site scripting vulnerability

Craft CMS before 3.6.13 has an XSS vulnerability.

Craft CMS XSS in RSS widget feed

Craft CMS before 3.7.29 allows XSS.

Craft CMS through 4.4.9 is vulnerable to HTML Injection.

Craft CMS vulnerable to cross site scripting in RSS feed widget

CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.

Craft CMS has Stored XSS in Table Field via "HTML" Column Type

Craft CMS stored XSS in indexedVolumes

Craft CMS stored XSS in review volume

Craft CMS stored XSS in breadcrumb list and title fields

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.

Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.

Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.

Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.