Craft CMS
by Craftcms
Source repositories
CVEs (99)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-8383 | Med | 0.35 | 5.3 | 0.01 | May 1, 2017 | Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder. | ||
| CVE-2026-27127 | Med | 0.34 | 6.3 | 0.00 | Feb 24, 2026 | Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU)… | ||
| CVE-2018-20418 | Med | 0.34 | 4.8 | 0.04 | Dec 24, 2018 | index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab. | ||
| CVE-2026-31859 | Med | 0.33 | 6.1 | 0.00 | Mar 11, 2026 | Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session. However, strip_tags() only removes HTML tags (angle brackets) -- it does not… | ||
| CVE-2023-31144 | Med | 0.33 | 6.1 | 0.00 | May 9, 2023 | Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4. | ||
| CVE-2023-30177 | Med | 0.33 | 6.1 | 0.00 | Apr 25, 2023 | CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name. | ||
| CVE-2022-28378 | Med | 0.33 | 6.1 | 0.01 | Apr 3, 2022 | Craft CMS before 3.7.29 allows XSS. | ||
| CVE-2021-27902 | Med | 0.33 | 6.1 | 0.01 | Jun 30, 2021 | An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads. | ||
| CVE-2021-32470 | Med | 0.33 | 6.1 | 0.01 | May 7, 2021 | Craft CMS before 3.6.13 has an XSS vulnerability. | ||
| CVE-2019-17496 | Med | 0.33 | 6.1 | 0.01 | Oct 11, 2019 | Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion. | ||
| CVE-2019-12823 | Med | 0.33 | 6.1 | 0.01 | Jun 18, 2019 | Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. | ||
| CVE-2017-8052 | Med | 0.33 | 6.1 | 0.01 | Apr 22, 2017 | Craft CMS before 2.6.2974 allows XSS attacks. | ||
| CVE-2024-45406 | Med | 0.29 | 5.5 | 0.00 | Sep 9, 2024 | Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input. | ||
| CVE-2023-33196 | Med | 0.29 | 5.5 | 0.01 | May 26, 2023 | Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7. | ||
| CVE-2023-33197 | Med | 0.29 | 5.5 | 0.01 | May 26, 2023 | Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6. | ||
| CVE-2026-33051 | Med | 0.28 | 5.4 | 0.00 | Mar 20, 2026 | Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw() combined with Craft::t() string interpolation. A… | ||
| CVE-2023-36259 | Med | 0.28 | 5.4 | 0.00 | Jan 30, 2024 | Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation. | ||
| CVE-2024-21622 | Med | 0.28 | 5.4 | 0.01 | Jan 3, 2024 | Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6.… | ||
| CVE-2023-2817 | Med | 0.28 | 5.4 | 0.00 | May 26, 2023 | A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries… | ||
| CVE-2022-37246 | Med | 0.28 | 5.4 | 0.00 | Sep 21, 2022 | Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label. |
- risk 0.35cvss 5.3epss 0.01
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
- risk 0.34cvss 6.3epss 0.00
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU)…
- risk 0.34cvss 4.8epss 0.04
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
- risk 0.33cvss 6.1epss 0.00
Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session. However, strip_tags() only removes HTML tags (angle brackets) -- it does not…
- risk 0.33cvss 6.1epss 0.00
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
- risk 0.33cvss 6.1epss 0.00
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
- risk 0.33cvss 6.1epss 0.01
Craft CMS before 3.7.29 allows XSS.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
- risk 0.33cvss 6.1epss 0.01
Craft CMS before 3.6.13 has an XSS vulnerability.
- risk 0.33cvss 6.1epss 0.01
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
- risk 0.33cvss 6.1epss 0.01
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.
- risk 0.33cvss 6.1epss 0.01
Craft CMS before 2.6.2974 allows XSS attacks.
- risk 0.29cvss 5.5epss 0.00
Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.
- risk 0.29cvss 5.5epss 0.01
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
- risk 0.29cvss 5.5epss 0.01
Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.
- risk 0.28cvss 5.4epss 0.00
Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw() combined with Craft::t() string interpolation. A…
- risk 0.28cvss 5.4epss 0.00
Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.
- risk 0.28cvss 5.4epss 0.01
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6.…
- risk 0.28cvss 5.4epss 0.00
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries…
- risk 0.28cvss 5.4epss 0.00
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.
Page 4 of 5