cbcvebase.

Craftcms Cms vulnerabilities

169 known vulnerabilities affecting craftcms/cms.

Total CVEs
169
CISA KEV
4
actively exploited
Public exploits
6
Exploited in wild
5
Severity breakdown
CRITICAL12HIGH67MEDIUM90

Vulnerabilities

Page 9 of 9
CVE-2026-84793P4MEDIUMCVSS 4.8≥ 5.0.0-RC1, < 5.10.112026-09-02
CVE-2026-84793 [MEDIUM] CWE-79 CVE-2026-84793: Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.
nvd
CVE-2017-8385P4MEDIUM≥ 0, < 2.6.29762022-05-17
CVE-2017-8385 [MEDIUM] CWE-640 Craft CMS subject to URL forgery Craft CMS subject to URL forgery Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
ghsaosv
CVE-2024-45406P4MEDIUMCVSS 4.8v>= 5.0.0, < 5.1.22024-09-09
CVE-2024-45406 [MEDIUM] CWE-79 CVE-2024-45406: Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrum Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.
ghsanvdosv
CVE-2026-56381P4MEDIUMCVSS 4.8≥ 5.0.0-RC1, < 5.8.222026-06-21
CVE-2026-56381 [MEDIUM] CWE-79 CVE-2026-56381: Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Pe Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.
nvd
CVE-2023-33194P4MEDIUMCVSS 4.8v>= 4.0.0-RC1, < 4.4.6v>= 3.0.0, <= 3.8.52023-05-26
CVE-2023-33194 [MEDIUM] CWE-80 CVE-2023-33194: Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
ghsanvdosv
CVE-2021-41824HIGH≥ 3.4.0, < 3.7.142021-10-18
CVE-2021-41824 [HIGH] CWE-1236 CSV Injection Vulnerability CSV Injection Vulnerability ### Impact In some circumstances, it was possible to export data in CSV format that could trigger a payload in old versions of Excel. If you are accepting user input from untrusted sources and will be exporting that data in CSV format from element index pages and there is a chance users will open that on old versions of Excel, then you should update. ### Patches This has been patched in Craft 3.7.14. ### R
ghsaosv
CVE-2017-8052MEDIUM≥ 0, < 2.6.29742022-05-17
CVE-2017-8052 [MEDIUM] CWE-79 Craft CMS XSS Vulnerability Craft CMS XSS Vulnerability Craft CMS before 2.6.2974 allows XSS attacks.
ghsaosv
CVE-2021-32470MEDIUM≥ 0, < 3.6.132022-03-18
CVE-2021-32470 [MEDIUM] CWE-79 Craft CMS Cross-site Scripting Vulnerability Craft CMS Cross-site Scripting Vulnerability Craft CMS before 3.6.13 has an XSS vulnerability.
ghsaosv
CVE-2022-28378MEDIUM≥ 0, < 3.7.292022-04-04
CVE-2022-28378 [MEDIUM] CWE-79 Cross-site Scripting in craftcms/cms Cross-site Scripting in craftcms/cms Craft CMS before 3.7.29 allows cross-site scripting.
ghsaosv
← Previous9 / 9
Craftcms Cms vulnerabilities | cvebase