Exposición de Statamic
CMS32
score de exposición
2098
sitios usan
0
en explotación
1
críticos
Análisis Vexday
Com 33 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, o Statamic apresenta taxa de exploração abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas no momento. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão frequente em plataformas de gerenciamento de conteúdo e que exige atenção contínua às políticas de sanitização de entrada. A CVE mais preocupante no cenário atual é CVE-2023-47129, embora seu score EPSS de 0,0112 indique baixa probabilidade de exploração em massa no curto prazo. O surgimento de 5 novas vulnerabilidades nos últimos 90 dias é um sinal de atividade relevante na superfície de ataque, recomendando acompanhamento próximo de atualizações e patches.
CVEs
37 resultadosCVE-2023-47129HIGHStatamic CMS remote code execution via front-end form uploadsEPSS 1.1%CVE-2023-48217HIGHRemote code execution via form uploads in statamic/cmsEPSS 1.1%CVE-2022-24784LOWDiscoverability of user password hash in Statamic CMSEPSS 1.0%CVE-2024-24570HIGHStatamic account takeover via XSS and password reset linkEPSS 0.7%CVE-2023-48701HIGHStatamic CMS vulnerable to Cross-site Scripting via uploaded assetsEPSS 0.7%CVE-2023-36828MEDIUMStatamic's Antlers sanitizer cannot effectively sanitize malicious SVGEPSS 0.7%CVE-2024-52600MEDIUMStatamic CMS has Path Traversal in Asset UploadEPSS 0.6%CVE-2026-27593CRITICALStatamic is vulnerable to account takeover via password reset link injectionEPSS 0.5%CVE-2026-49287HIGHStatamic CMS vulnerable to unsafe method invocation via collection sorting allows data destructionEPSS 0.5%CVE-2026-28425HIGHStatamic vulnerable to remote code execution via Antlers-enabled control panel inputsEPSS 0.4%CVE-2026-27939HIGHStatamic allows Authenticated Control Panel users to escalate privileges via elevated session bypassEPSS 0.4%CVE-2026-28423MEDIUMStatamic Vulnerable to Server-Side Request Forgery via GlideEPSS 0.4%CVE-2026-33171MEDIUMStatamic has a path traversal in file dictionary fieldtypeEPSS 0.3%CVE-2026-33172HIGHStatamic has Stored XSS via SVG Sanitization BypassEPSS 0.3%CVE-2026-41175HIGHStatamic: Unsafe method invocation via query value resolution allows data destructionEPSS 0.3%CVE-2026-25759HIGHStatmatic affected by privilege escalation via stored cross-site scriptingEPSS 0.3%CVE-2025-64112HIGHStatmatic vulnerable to Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-25633MEDIUMStatamic's missing authorization allows access to assetsEPSS 0.3%CVE-2026-27196HIGHStatamic affected by privilege escalation via stored Cross-site ScriptingEPSS 0.3%CVE-2026-49288MEDIUMStatamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesEPSS 0.3%