Vulnerabilidades em craftcms

168 resultados
Análise Vexday

O Craft CMS acumula 98 CVEs catalogadas, com uma taxa de exploração ativa que está bem acima da média do catálogo CISA KEV — 6,8 vezes superior —, sinalizando que vulnerabilidades nessa plataforma atraem atenção de agentes maliciosos de forma desproporcional. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), embora o risco mais imediato esteja concentrado na CVE-2025-32432, atualmente em exploração ativa e com EPSS de 0,998, indicando probabilidade altíssima de exploração em ambiente real. O volume de 16 CVEs surgidas nos últimos 90 dias reforça um ritmo de descoberta acelerado, exigindo ciclos de atualização frequentes por parte das equipes responsáveis por instâncias em produção. A presença de 3 CVEs no KEV, 5 de severidade crítica e 3 com PoC pública torna a priorização de patches não apenas recomendável, mas urgente.

CVE-2026-28782MEDIUMCraft has a Permission Bypass and IDOR in Duplicate Entry ActionEPSS 0.3%CVE-2026-29176MEDIUMCraft Commerce has Stored XSS in Inventory Location NameEPSS 0.3%CVE-2026-72785CRITICALCraft CMS before 5.10.6 Authorization Bypass via structures/move-elementEPSS 0.3%CVE-2026-92589MEDIUMCraft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorderEPSS 0.3%CVE-2026-72787MEDIUMCraft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft NameEPSS 0.3%CVE-2026-33051MEDIUMCraft CMS Vulnerable to Stored XSS in Revision Context MenuEPSS 0.3%CVE-2026-84793MEDIUMCraft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site nameEPSS 0.3%CVE-2026-41128MEDIUMCraft CMS has a Missing Authorization Check on User Group Removal via save-permissions ActionEPSS 0.2%CVE-2026-27126MEDIUMCraft CMS has Stored XSS in Table Field via "HTML" Column TypeEPSS 0.2%CVE-2026-29177LOWCraft Commerce has Stored XSS in Craft Commerce Order Details SlideoutEPSS 0.2%CVE-2026-72784MEDIUMCraft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutationEPSS 0.2%CVE-2026-29175HIGHMultiple Stored XSS in Commerce Inventory Page Leading to Session HijackingEPSS 0.2%CVE-2026-92590MEDIUMCraft CMS 5.7.0 before 5.10.13 Stored XSS via Generated FieldsEPSS 0.2%CVE-2026-109306MEDIUMCraft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-editionEPSS 0.2%CVE-2026-56393MEDIUMCraft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field OptionsEPSS 0.2%CVE-2026-33161LOWCraft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized usersEPSS 0.2%CVE-2026-56383MEDIUMCraft CMS - Stored XSS in Table Field via Row Heading Column TypeEPSS 0.2%CVE-2026-31859MEDIUMCraft has Reflective XSS via incomplete return URL sanitizationEPSS 0.2%CVE-2026-29113LOWCraft has a potential information disclosure vulnerability in preview tokensEPSS 0.2%CVE-2026-72783MEDIUMCraft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContainedEPSS 0.2%