Skip to content
OpenAdvisories

Vendor

craftcms

171 known vulnerabilities.

Products

cms 144 commerce 21 aws-s3 1 google-cloud 1 commerce-mollie 1 webhooks 1 azure-blob 1 CraftCMS 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-32432 Exploited Public exploit EPSS 100%

    Craft CMS Allows Remote Code Execution

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. …

    craftcms cms craftcms/cms Packagist
    KEV Mar 20, 2026
  • High 8.1
    CVE-2025-23209 Exploited EPSS 22%

    Potential RCE with a compromised security key in craft/cms

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running…

    craftcms cms craftcms/cms Packagist
    KEV Feb 20, 2025
  • Critical 9.3
    CVE-2024-56145 Exploited Public exploit EPSS 97%

    RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified…

    craftcms cms craftcms/cms Packagist
    KEV Jun 2, 2025