Vulnerabilities in craftcms
168 resultsCVE-2026-28784HIGHCraft is affected by potential authenticated Remote Code Execution via Twig SSTIEPSS 0.6%CVE-2024-21622MEDIUMCraft CMS Privilege EscalationEPSS 0.6%CVE-2025-68456HIGHUnauthenticated Craft CMS users can trigger a database backupEPSS 0.6%CVE-2026-25495HIGHCraft has a SQL Injection in Element Indexes via criteria[orderBy]EPSS 0.6%CVE-2026-92593HIGHCraft CMS 5.10.0 before 5.10.13 Authenticated Remote Code ExecutionEPSS 0.5%CVE-2026-32264HIGHCraft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsControllerEPSS 0.5%CVE-2025-54417MEDIUMCraft contains a theoretical bypass for CVE-2025-23209EPSS 0.5%CVE-2026-32263HIGHCraft CMS vulnerable to behavior injection RCE via EntryTypesControllerEPSS 0.5%CVE-2026-84795CRITICALCraft CMS before 5.10.11 Authentication Bypass via Admin Flag InheritanceEPSS 0.5%CVE-2026-55795MEDIUMCraft Commerce: Coupon Code Brute-Force via Rate Limit BypassEPSS 0.5%CVE-2026-28783CRITICALCraft has a Twig Function Blocklist BypassEPSS 0.5%CVE-2026-79991HIGHAuthenticated SQL Injection via nested eager-loading criteriaEPSS 0.5%CVE-2026-56394HIGHCraft CMS - Authenticated Path Traversal in assets/icon Extension ParameterEPSS 0.5%CVE-2026-28696HIGHCraft affected by IDOR via GraphQL @parseRefsEPSS 0.5%CVE-2026-29174HIGHCraft Commerce has a SQL Injection in Commerce Inventory Table SortingEPSS 0.5%CVE-2026-109308HIGHCraft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior InjectionEPSS 0.5%CVE-2026-27127HIGHCraft CMS has Cloud Metadata SSRF Protection Bypass via DNS RebindingEPSS 0.5%CVE-2026-109305HIGHCraft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has everyEPSS 0.5%CVE-2026-32271HIGHCraft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue WidgetEPSS 0.5%CVE-2026-29172HIGHCraft Commerce has a SQL Injection in Commerce Purchasables Table SortingEPSS 0.5%