Vulnerabilities in craftcms
168 resultsCVE-2025-68437MEDIUMCraft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload MutationEPSS 0.5%CVE-2026-25497HIGHCraft has a GraphQL Asset Mutation Privilege EscalationEPSS 0.5%CVE-2026-84796HIGHCraft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope BypassEPSS 0.5%CVE-2026-25492MEDIUMCraft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying hostEPSS 0.5%CVE-2026-55791MEDIUMCraft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsEPSS 0.5%CVE-2026-27129MEDIUMCloud Metadata SSRF Protection Bypass via IPv6 ResolutionEPSS 0.5%CVE-2026-72786HIGHCraft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password ResetEPSS 0.5%CVE-2026-55790HIGHCraft CMS: DOM XSS via GitHub issue title in CraftSupport widgetEPSS 0.5%CVE-2024-41800MEDIUMCraft CMS Allows TOTP Token To Stay Valid After UseEPSS 0.5%CVE-2026-79988HIGHAuthenticated RCE through Twig sandbox escapeEPSS 0.5%CVE-2026-79990HIGHGQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/deleteEPSS 0.4%CVE-2026-84801HIGHCraft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsersEPSS 0.4%CVE-2026-92594HIGHCraft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQLEPSS 0.4%CVE-2026-50281HIGHCraft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elementsEPSS 0.4%CVE-2026-79989HIGHArbitrary user password reset leading to administrator account takeoverEPSS 0.4%CVE-2026-55794HIGHCraft CMS: Potential authenticated Remote Code Execution via referrer redirectEPSS 0.4%CVE-2026-44010HIGHCraft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII DisclosureEPSS 0.4%CVE-2026-25496MEDIUMCraft has a stored XSS in Number Prefix & Suffix FieldsEPSS 0.4%CVE-2026-92591HIGHCraft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via InstallerEPSS 0.4%CVE-2026-32261HIGHRCE via SSTI for users with permissions to access the Craft CMS Webhooks pluginEPSS 0.4%