Vulnerabilidades en CraftCMS
168 resultadosCVE-2026-112771HIGHCraft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array FiltersEPSS 0.3%CVE-2026-109304MEDIUMCraft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocumentEPSS 0.3%CVE-2026-86731HIGHCraft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersControllerEPSS 0.3%CVE-2026-32262MEDIUMCraft CMS has a Path Traversal Vulnerability in AssetsControllerEPSS 0.3%CVE-2026-32272HIGHCraft Commerce: Blind SQL Injection via hasVariant/hasProductEPSS 0.3%CVE-2026-25488MEDIUMCraft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege EscalationEPSS 0.3%CVE-2026-25484MEDIUMCraft Commerce has Stored XSS in Product Type NameEPSS 0.3%CVE-2026-25490MEDIUMCraft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege EscalationEPSS 0.3%CVE-2026-25485MEDIUMCraft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege EscalationEPSS 0.3%CVE-2026-25487MEDIUMCraft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege EscalationEPSS 0.3%CVE-2026-25522MEDIUMCraft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege EscalationEPSS 0.3%CVE-2026-84792MEDIUMCraft CMS before 5.10.11 Broken Access Control via element-indexesEPSS 0.3%CVE-2026-32270LOWCraft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous paymentsEPSS 0.3%CVE-2026-33162MEDIUMCraft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissionsEPSS 0.3%CVE-2026-25486MEDIUMCraft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege EscalationEPSS 0.3%CVE-2026-84797MEDIUMCraft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicateEPSS 0.3%CVE-2026-84799MEDIUMCraft CMS before 5.11.0 PII Disclosure via GraphQL User RelationsEPSS 0.3%CVE-2026-84802MEDIUMCraft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsControllerEPSS 0.3%CVE-2025-68436MEDIUMCraft CMS vulnerable to potential information disclosure via unchecked asset relocationEPSS 0.3%CVE-2026-41129MEDIUMCraft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads MutationsEPSS 0.3%