Skip to content
OpenAdvisories

Package · Packagist

processwire/processwire

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 6.5
    CVE-2025-60790

    ProcessWire CMS vulnerable to resource-exhaustion Denial of Service

    ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.

    processwire/processwire Packagist
  • Medium 4.2
    CVE-2024-41597

    ProcessWire Cross Site Request Forgery vulnerability

    Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situa…

    processwire/processwire Packagist
  • High 7.2
    CVE-2023-24676

    Arbitrary Code Execution in Processwire

    An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to ent…

    processwire/processwire Packagist
  • Medium 6.1
    CVE-2022-40487

    ProcessWire vulnerable to Cross-site Scripting

    ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payloa…

    processwire/processwire Packagist
  • Medium 6.5
    CVE-2022-40488

    ProcessWire vulnerable to Cross-Site Request Forgery

    ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).

    processwire/processwire Packagist