Skip to content
OpenAdvisories

Package · Packagist

craftcms/cms

127 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

127 results · Feed

  • Medium 4.8
    CVE-2018-20418 Public exploit

    Craft CMS Cross-site Scripting (XSS) Vulnerability

    index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

    craftcms/cms Packagist
  • High 8.8
    CVE-2018-3814

    Craft CMS PHP Code Injection Vulnerability

    Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.

    craftcms/cms Packagist
  • Medium 5.4
    CVE-2017-9516 Public exploit

    Craft CMS XSS Vulnerability

    Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

    craftcms/cms Packagist
  • Medium 5.3
    CVE-2017-8385

    Craft CMS subject to URL forgery

    Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.

    craftcms/cms Packagist
  • Medium 5.3
    CVE-2017-8383

    Craft CMS Unauthorized View

    Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.

    craftcms/cms Packagist
  • Medium 6.1
    CVE-2017-8384

    Craft CMS XSS Vulnerability

    Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.

    craftcms/cms Packagist
  • Medium 6.1
    CVE-2017-8052

    Craft CMS XSS Vulnerability

    Craft CMS before 2.6.2974 allows XSS attacks.

    craftcms/cms Packagist