Vulnerabilidades en craftcms

147 resultados
Análisis Vexday

O Craft CMS acumula 98 CVEs catalogadas, com uma taxa de exploração ativa que está bem acima da média do catálogo CISA KEV — 6,8 vezes superior —, sinalizando que vulnerabilidades nessa plataforma atraem atenção de agentes maliciosos de forma desproporcional. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), embora o risco mais imediato esteja concentrado na CVE-2025-32432, atualmente em exploração ativa e com EPSS de 0,998, indicando probabilidade altíssima de exploração em ambiente real. O volume de 16 CVEs surgidas nos últimos 90 dias reforça um ritmo de descoberta acelerado, exigindo ciclos de atualização frequentes por parte das equipes responsáveis por instâncias em produção. A presença de 3 CVEs no KEV, 5 de severidade crítica e 3 com PoC pública torna a priorização de patches não apenas recomendável, mas urgente.

CVE-2026-50284HIGHCraft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assetsEPSS 0.4%CVE-2026-32261HIGHRCE via SSTI for users with permissions to access the Craft CMS Webhooks pluginEPSS 0.4%CVE-2026-25496MEDIUMCraft has a stored XSS in Number Prefix & Suffix FieldsEPSS 0.4%CVE-2026-25493MEDIUMCraft has a SSRF in GraphQL Asset Mutation via HTTP RedirectEPSS 0.4%CVE-2026-25494MEDIUMCraft has a SSRF in GraphQL Asset Mutation via Alternative IP NotationEPSS 0.4%CVE-2026-50283MEDIUMCraft CMS: Unauthorized Deletion of Source Assets During File ReplacementEPSS 0.4%CVE-2026-50279HIGHCraft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gapEPSS 0.4%CVE-2026-44011HIGHCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 0.4%CVE-2026-56385MEDIUMCraft CMS - Authorization Bypass in assets/preview-file EndpointEPSS 0.4%CVE-2026-79987HIGHLow-privilege RCE through element-search eager loadingEPSS 0.4%CVE-2026-33160LOWCraft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URLEPSS 0.4%CVE-2024-45406MEDIUMCraft CMS stored XSS in breadcrumb list and title fieldsEPSS 0.4%CVE-2026-33158MEDIUMCraft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)EPSS 0.4%CVE-2026-44010HIGHCraft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII DisclosureEPSS 0.4%CVE-2026-50282MEDIUMCraft CMS: Unauthorized Deletion of Destination Folders During Forced MovesEPSS 0.4%CVE-2026-31858HIGHCraftCMS's `ElementSearchController` Affected by Blind SQL InjectionEPSS 0.4%CVE-2026-32268HIGHAzure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerabilityEPSS 0.3%CVE-2026-32266LOWGoogle Cloud Storage for Craft CMS has an Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-32265MEDIUMAmazon S3 for Craft CMS has an Information Disclosure vulnerabilityEPSS 0.3%CVE-2026-44012HIGHCraft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information DisclosureEPSS 0.3%