Vulnerabilities in CraftCMS
168 resultsCVE-2023-31144MEDIUMCraft CMS vulnerable to cross site scripting in RSS feed widgetEPSS 0.4%CVE-2026-50280MEDIUMCraft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save checkEPSS 0.4%CVE-2026-112775HIGHCraft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-passwordEPSS 0.4%CVE-2026-25493MEDIUMCraft has a SSRF in GraphQL Asset Mutation via HTTP RedirectEPSS 0.4%CVE-2026-25494MEDIUMCraft has a SSRF in GraphQL Asset Mutation via Alternative IP NotationEPSS 0.4%CVE-2026-31858HIGHCraftCMS's `ElementSearchController` Affected by Blind SQL InjectionEPSS 0.4%CVE-2026-28781HIGHCraft Affected by Entries Authorship Spoofing via Mass AssignmentEPSS 0.4%CVE-2026-50284HIGHCraft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assetsEPSS 0.4%CVE-2026-112776CRITICALCraft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via MutationsEPSS 0.4%CVE-2026-72782HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Environment Variable LeakEPSS 0.4%CVE-2026-72780HIGHCraft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkeyEPSS 0.4%CVE-2026-33159MEDIUMCraft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted usersEPSS 0.4%CVE-2026-72779HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObjectEPSS 0.4%CVE-2026-32268HIGHAzure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerabilityEPSS 0.4%CVE-2026-115938HIGHLow privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCEEPSS 0.4%CVE-2026-115935HIGHControl panel only API response emulation replaces "securityKey" and reaches server RCEEPSS 0.4%CVE-2026-29173LOWCraft Commerce has Stored XSS while updating Order Status from Orders TableEPSS 0.4%CVE-2026-32266LOWGoogle Cloud Storage for Craft CMS has an Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-32265MEDIUMAmazon S3 for Craft CMS has an Information Disclosure vulnerabilityEPSS 0.4%CVE-2026-50283MEDIUMCraft CMS: Unauthorized Deletion of Source Assets During File ReplacementEPSS 0.4%