Skip to content
OpenAdvisories

Vendor

puemos

2 known vulnerabilities.

Products

craftplan 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-111349

    Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL

    Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or…

    puemos craftplan
  • Medium 5.9
    CVE-2026-76876

    Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

    Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the set…

    puemos craftplan