Mura CMS
by Murasoftware
CVEs (10)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-67830 | Cri | 0.64 | 9.8 | 0.00 | Mar 18, 2026 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection. | ||
| CVE-2025-67829 | Cri | 0.64 | 9.8 | 0.00 | Mar 18, 2026 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection. | ||
| CVE-2022-47003 | Cri | 0.64 | 9.8 | 0.04 | Feb 1, 2023 | A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request. | ||
| CVE-2025-55044 | Hig | 0.57 | 8.8 | 0.00 | Mar 18, 2026 | The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CSRF. The vulnerable cTrash.restore function lacks CSRF token validation, enabling malicious websites to forge requests… | ||
| CVE-2025-55040 | Hig | 0.57 | 8.8 | 0.00 | Mar 18, 2026 | The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vulnerable cForm.importform function lacks CSRF token validation, enabling malicious websites to forge file upload requests… | ||
| CVE-2025-55046 | Hig | 0.53 | 8.1 | 0.00 | Mar 18, 2026 | MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a simple CSRF attack. The vulnerable cTrash.empty function lacks CSRF token validation, enabling malicious websites to forge… | ||
| CVE-2025-55041 | Hig | 0.52 | 8.0 | 0.00 | Mar 18, 2026 | MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any user to any group without proper authorization checks. The vulnerable function… | ||
| CVE-2025-55045 | Hig | 0.46 | 7.1 | 0.00 | Mar 18, 2026 | The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable cUsers.updateAddress function lacks CSRF token validation, enabling malicious websites to forge requests that add, modify, or… | ||
| CVE-2025-55043 | Med | 0.42 | 6.5 | 0.00 | Mar 18, 2026 | MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible… | ||
| CVE-2026-12257 | Cri | 0.00 | — | 0.00 | Jul 13, 2026 | Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being… |
- risk 0.64cvss 9.8epss 0.00
Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection.
- risk 0.64cvss 9.8epss 0.00
Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection.
- risk 0.64cvss 9.8epss 0.04
A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.
- risk 0.57cvss 8.8epss 0.00
The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CSRF. The vulnerable cTrash.restore function lacks CSRF token validation, enabling malicious websites to forge requests…
- risk 0.57cvss 8.8epss 0.00
The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vulnerable cForm.importform function lacks CSRF token validation, enabling malicious websites to forge file upload requests…
- risk 0.53cvss 8.1epss 0.00
MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a simple CSRF attack. The vulnerable cTrash.empty function lacks CSRF token validation, enabling malicious websites to forge…
- risk 0.52cvss 8.0epss 0.00
MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any user to any group without proper authorization checks. The vulnerable function…
- risk 0.46cvss 7.1epss 0.00
The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable cUsers.updateAddress function lacks CSRF token validation, enabling malicious websites to forge requests that add, modify, or…
- risk 0.42cvss 6.5epss 0.00
MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible…
- risk 0.00cvss —epss 0.00
Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being…