Craft CMS craftcms Craft CMS

Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.

Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.

A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.

Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.

Craft CMS Vulnerable to Stored XSS in Revision Context Menu

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.

Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL

Craft CMS has a Path Traversal Vulnerability in AssetsController

Craft has a Permission Bypass and IDOR in Duplicate Entry Action

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

CraftCMS stored XSS in Quick Post widget error message

Craft has a stored XSS in Number Prefix & Suffix Fields

Craft has a Stored XSS in Entry Types Name

Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users

Craft has a potential information disclosure vulnerability in preview tokens