Vulnerabilities in craftcms
168 resultsCVE-2023-23927MEDIUMCraft CMS stored cross-site scripting vulnerabilityEPSS 0.8%CVE-2026-72781HIGHCraft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox EscapeEPSS 0.8%CVE-2020-37071CRITICALCraftCMS 3 vCard Plugin 1.0.0 - Remote Code ExecutionEPSS 0.7%CVE-2024-52292HIGHCraft Allows Attackers to Read Arbitrary System FilesEPSS 0.7%CVE-2026-112770HIGHCraft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-CallableEPSS 0.7%CVE-2026-112772HIGHCraft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform InjectionEPSS 0.7%CVE-2026-112773HIGHCraft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior InjectionEPSS 0.7%CVE-2026-86730HIGHCraft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCEEPSS 0.7%CVE-2026-105985HIGHAuthenticated RCE via render-components Entry Type overridesEPSS 0.7%CVE-2023-33197MEDIUMCraft CMS stored XSS in indexedVolumesEPSS 0.7%CVE-2026-56382HIGHCraft CMS - Remote Code Execution via Missing Config Sanitization in FieldsControllerEPSS 0.7%CVE-2026-28695HIGHCraft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadgetEPSS 0.7%CVE-2023-33196MEDIUMCraft CMS stored XSS in review volumeEPSS 0.7%CVE-2023-33195MEDIUMCraft CMS XSS in RSS widget feedEPSS 0.7%CVE-2026-79987HIGHLow-privilege RCE through element-search eager loadingEPSS 0.6%CVE-2026-92592HIGHCraft CMS before 4.18.6 Remote Code Execution via signed cookieEPSS 0.6%CVE-2026-112774HIGHCraft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field LayoutEPSS 0.6%CVE-2026-44011HIGHCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 0.6%CVE-2023-33194LOWCraftCMS stored XSS in Quick Post widget error messageEPSS 0.6%CVE-2026-112777HIGHCraft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCEEPSS 0.6%