Vulnerabilities in craftcms
168 resultsCVE-2026-50279HIGHCraft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gapEPSS 0.4%CVE-2026-33160LOWCraft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URLEPSS 0.4%CVE-2026-33158MEDIUMCraft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)EPSS 0.4%CVE-2026-56385MEDIUMCraft CMS - Authorization Bypass in assets/preview-file EndpointEPSS 0.4%CVE-2024-45406MEDIUMCraft CMS stored XSS in breadcrumb list and title fieldsEPSS 0.4%CVE-2026-25491LOWCraft has a Stored XSS in Entry Types NameEPSS 0.4%CVE-2026-84800HIGHCraft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-fileEPSS 0.4%CVE-2026-84798HIGHCraft CMS before 5.10.11 Authorization Bypass via actionDeleteForSiteEPSS 0.4%CVE-2026-84794HIGHCraft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-assetEPSS 0.4%CVE-2026-50282MEDIUMCraft CMS: Unauthorized Deletion of Destination Folders During Forced MovesEPSS 0.4%CVE-2026-25482MEDIUMCraft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)EPSS 0.3%CVE-2026-25483MEDIUMCraft Commerce has Stored XSS via Order Status Message with potential database exfiltrationEPSS 0.3%CVE-2026-44012HIGHCraft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information DisclosureEPSS 0.3%CVE-2026-55792MEDIUMCraft CMS: Sensitive File Disclosure / Server-Side File ReadEPSS 0.3%CVE-2026-56384MEDIUMCraft CMS - Missing Authorization in assets/preview-thumb EndpointEPSS 0.3%CVE-2026-41130MEDIUMCraft CMS has a host header injection leading to SSRF via resource-js endpointEPSS 0.3%CVE-2026-31867MEDIUMCraft Commerce has a Potential IDOR in Commerce cartsEPSS 0.3%CVE-2026-25489MEDIUMCraft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege EscalationEPSS 0.3%CVE-2026-55793MEDIUMCraft CMS: Stored XSS via Structure entry title in table viewEPSS 0.3%CVE-2026-29069MEDIUMCraft has an unauthenticated activation email trigger with potential user enumerationEPSS 0.3%