Vulnerabilidades em craftcms

168 resultados
Análise Vexday

O Craft CMS acumula 98 CVEs catalogadas, com uma taxa de exploração ativa que está bem acima da média do catálogo CISA KEV — 6,8 vezes superior —, sinalizando que vulnerabilidades nessa plataforma atraem atenção de agentes maliciosos de forma desproporcional. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), embora o risco mais imediato esteja concentrado na CVE-2025-32432, atualmente em exploração ativa e com EPSS de 0,998, indicando probabilidade altíssima de exploração em ambiente real. O volume de 16 CVEs surgidas nos últimos 90 dias reforça um ritmo de descoberta acelerado, exigindo ciclos de atualização frequentes por parte das equipes responsáveis por instâncias em produção. A presença de 3 CVEs no KEV, 5 de severidade crítica e 3 com PoC pública torna a priorização de patches não apenas recomendável, mas urgente.

CVE-2025-68437MEDIUMCraft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload MutationEPSS 0.5%CVE-2026-25497HIGHCraft has a GraphQL Asset Mutation Privilege EscalationEPSS 0.5%CVE-2026-84796HIGHCraft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope BypassEPSS 0.5%CVE-2026-25492MEDIUMCraft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying hostEPSS 0.5%CVE-2026-55791MEDIUMCraft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsEPSS 0.5%CVE-2026-27129MEDIUMCloud Metadata SSRF Protection Bypass via IPv6 ResolutionEPSS 0.5%CVE-2026-72786HIGHCraft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password ResetEPSS 0.5%CVE-2026-55790HIGHCraft CMS: DOM XSS via GitHub issue title in CraftSupport widgetEPSS 0.5%CVE-2024-41800MEDIUMCraft CMS Allows TOTP Token To Stay Valid After UseEPSS 0.5%CVE-2026-79988HIGHAuthenticated RCE through Twig sandbox escapeEPSS 0.5%CVE-2026-79990HIGHGQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/deleteEPSS 0.4%CVE-2026-84801HIGHCraft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsersEPSS 0.4%CVE-2026-92594HIGHCraft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQLEPSS 0.4%CVE-2026-50281HIGHCraft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elementsEPSS 0.4%CVE-2026-79989HIGHArbitrary user password reset leading to administrator account takeoverEPSS 0.4%CVE-2026-55794HIGHCraft CMS: Potential authenticated Remote Code Execution via referrer redirectEPSS 0.4%CVE-2026-44010HIGHCraft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII DisclosureEPSS 0.4%CVE-2026-25496MEDIUMCraft has a stored XSS in Number Prefix & Suffix FieldsEPSS 0.4%CVE-2026-92591HIGHCraft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via InstallerEPSS 0.4%CVE-2026-32261HIGHRCE via SSTI for users with permissions to access the Craft CMS Webhooks pluginEPSS 0.4%