Packagist (Composer) package
craftcms/cms
pkg:composer/craftcms/cms
Vulnerabilities (103)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-37246 | Med | 5.4 | >= 4.0.0-RC1, < 4.2.1 | 4.2.1 | Sep 21, 2022 | Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label. | |
| CVE-2022-37251 | Med | 5.4 | >= 3.7.0-beta.1, < 3.7.55.2 | 3.7.55.2 | Sep 16, 2022 | Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts. | |
| CVE-2022-37247 | Med | 5.4 | >= 4.0.0-RC1, < 4.2.1 | 4.2.1 | Sep 16, 2022 | Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page. | |
| CVE-2022-37248 | Med | 5.4 | >= 4.0.0-RC1, < 4.2.1 | 4.2.1 | Sep 16, 2022 | Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php. | |
| CVE-2022-37250 | Med | 5.4 | >= 4.0.0-RC1, < 4.2.1 | 4.2.1 | Sep 16, 2022 | Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount. | |
| CVE-2022-29933 | Hig | 8.8 | < 3.7.36 | 3.7.36 | May 9, 2022 | Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, th | |
| CVE-2022-28378 | Med | 6.1 | < 3.7.29 | 3.7.29 | Apr 3, 2022 | Craft CMS before 3.7.29 allows XSS. | |
| CVE-2021-41824 | Hig | 8.8 | >= 3.4.0, < 3.7.14 | 3.7.14 | Sep 30, 2021 | Craft CMS before 3.7.14 allows CSV injection. | |
| CVE-2021-27903 | Cri | 9.8 | < 3.6.7 | 3.6.7 | Jun 30, 2021 | An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session). | |
| CVE-2021-27902 | Med | 6.1 | < 3.6.0 | 3.6.0 | Jun 30, 2021 | An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads. | |
| CVE-2021-32470 | Med | 6.1 | < 3.6.13 | 3.6.13 | May 7, 2021 | Craft CMS before 3.6.13 has an XSS vulnerability. | |
| CVE-2020-19626 | Med | 5.4 | < 3.1.33 | 3.1.33 | Mar 26, 2021 | Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new. | |
| CVE-2019-15929 | Cri | 9.8 | < 3.1.7 | 3.1.7 | Oct 24, 2019 | In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them. | |
| CVE-2019-17496 | Med | 6.1 | < 3.3.8 | 3.3.8 | Oct 11, 2019 | Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion. | |
| CVE-2019-12823 | Med | 6.1 | < 3.1.31 | 3.1.31 | Jun 18, 2019 | Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. | |
| CVE-2018-20465 | Hig | 7.2 | <= 3.0.34 | — | Dec 25, 2018 | Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes | |
| CVE-2018-20418 | Med | 4.8 | <= 3.0.25 | — | Dec 24, 2018 | index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab. | |
| CVE-2018-3814 | Hig | 8.8 | <= 2.6.3000 | — | Jan 1, 2018 | Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension. | |
| CVE-2017-9516 | Med | 5.4 | < 2.6.2982 | 2.6.2982 | Jun 8, 2017 | Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file. | |
| CVE-2017-8385 | Med | 5.3 | < 2.6.2976 | 2.6.2976 | May 1, 2017 | Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message. |
- affected >= 4.0.0-RC1, < 4.2.1fixed 4.2.1
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.
- affected >= 3.7.0-beta.1, < 3.7.55.2fixed 3.7.55.2
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.
- affected >= 4.0.0-RC1, < 4.2.1fixed 4.2.1
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.
- affected >= 4.0.0-RC1, < 4.2.1fixed 4.2.1
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.
- affected >= 4.0.0-RC1, < 4.2.1fixed 4.2.1
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.
- affected < 3.7.36fixed 3.7.36
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, th
- affected < 3.7.29fixed 3.7.29
Craft CMS before 3.7.29 allows XSS.
- affected >= 3.4.0, < 3.7.14fixed 3.7.14
Craft CMS before 3.7.14 allows CSV injection.
- affected < 3.6.7fixed 3.6.7
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
- affected < 3.6.0fixed 3.6.0
An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
- affected < 3.6.13fixed 3.6.13
Craft CMS before 3.6.13 has an XSS vulnerability.
- affected < 3.1.33fixed 3.1.33
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
- affected < 3.1.7fixed 3.1.7
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
- affected < 3.3.8fixed 3.3.8
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
- affected < 3.1.31fixed 3.1.31
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.
- affected <= 3.0.34
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes
- affected <= 3.0.25
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
- affected <= 2.6.3000
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.
- affected < 2.6.2982fixed 2.6.2982
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
- affected < 2.6.2976fixed 2.6.2976
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
Page 5 of 6