Vulnerabilidades em craftcms

168 resultados
Análise Vexday

O Craft CMS acumula 98 CVEs catalogadas, com uma taxa de exploração ativa que está bem acima da média do catálogo CISA KEV — 6,8 vezes superior —, sinalizando que vulnerabilidades nessa plataforma atraem atenção de agentes maliciosos de forma desproporcional. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), embora o risco mais imediato esteja concentrado na CVE-2025-32432, atualmente em exploração ativa e com EPSS de 0,998, indicando probabilidade altíssima de exploração em ambiente real. O volume de 16 CVEs surgidas nos últimos 90 dias reforça um ritmo de descoberta acelerado, exigindo ciclos de atualização frequentes por parte das equipes responsáveis por instâncias em produção. A presença de 3 CVEs no KEV, 5 de severidade crítica e 3 com PoC pública torna a priorização de patches não apenas recomendável, mas urgente.

CVE-2023-31144MEDIUMCraft CMS vulnerable to cross site scripting in RSS feed widgetEPSS 0.4%CVE-2026-50280MEDIUMCraft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save checkEPSS 0.4%CVE-2026-112775HIGHCraft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-passwordEPSS 0.4%CVE-2026-25493MEDIUMCraft has a SSRF in GraphQL Asset Mutation via HTTP RedirectEPSS 0.4%CVE-2026-25494MEDIUMCraft has a SSRF in GraphQL Asset Mutation via Alternative IP NotationEPSS 0.4%CVE-2026-31858HIGHCraftCMS's `ElementSearchController` Affected by Blind SQL InjectionEPSS 0.4%CVE-2026-28781HIGHCraft Affected by Entries Authorship Spoofing via Mass AssignmentEPSS 0.4%CVE-2026-50284HIGHCraft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assetsEPSS 0.4%CVE-2026-112776CRITICALCraft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via MutationsEPSS 0.4%CVE-2026-72782HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Environment Variable LeakEPSS 0.4%CVE-2026-72780HIGHCraft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkeyEPSS 0.4%CVE-2026-33159MEDIUMCraft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted usersEPSS 0.4%CVE-2026-72779HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObjectEPSS 0.4%CVE-2026-32268HIGHAzure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerabilityEPSS 0.4%CVE-2026-115938HIGHLow privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCEEPSS 0.4%CVE-2026-115935HIGHControl panel only API response emulation replaces "securityKey" and reaches server RCEEPSS 0.4%CVE-2026-29173LOWCraft Commerce has Stored XSS while updating Order Status from Orders TableEPSS 0.4%CVE-2026-32266LOWGoogle Cloud Storage for Craft CMS has an Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-32265MEDIUMAmazon S3 for Craft CMS has an Information Disclosure vulnerabilityEPSS 0.4%CVE-2026-50283MEDIUMCraft CMS: Unauthorized Deletion of Source Assets During File ReplacementEPSS 0.4%