Vulnerabilities > Craftcms

DATE CVE VULNERABILITY TITLE RISK
2021-09-30 CVE-2021-41824 Improper Neutralization of Formula Elements in a CSV File vulnerability in Craftcms Craft CMS
Craft CMS before 3.7.14 allows CSV injection.
network
craftcms CWE-1236
6.8
2021-06-30 CVE-2021-27902 Cross-site Scripting vulnerability in Craftcms Craft CMS
An issue was discovered in Craft CMS before 3.6.0.
network
craftcms CWE-79
4.3
2021-06-30 CVE-2021-27903 Code Injection vulnerability in Craftcms Craft CMS
An issue was discovered in Craft CMS before 3.6.7.
network
low complexity
craftcms CWE-94
7.5
2021-05-07 CVE-2021-32470 Cross-site Scripting vulnerability in Craftcms Craft CMS
Craft CMS before 3.6.13 has an XSS vulnerability.
network
craftcms CWE-79
4.3
2021-03-26 CVE-2020-19626 Cross-site Scripting vulnerability in Craftcms Craft CMS 3.1.31
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
network
craftcms CWE-79
3.5
2020-03-04 CVE-2020-9757 Injection vulnerability in Craftcms Craft CMS
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
network
low complexity
craftcms CWE-74
5.0
2019-12-31 CVE-2019-9554 Cross-site Scripting vulnerability in Craftcms Craft CMS 3.1.12
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.
network
craftcms CWE-79
4.3
2019-10-24 CVE-2019-15929 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Craftcms Craft CMS
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
network
low complexity
craftcms CWE-640
5.0
2019-10-11 CVE-2019-17496 Cross-site Scripting vulnerability in Craftcms Craft CMS
Craft CMS before 3.3.8 has stored XSS via a name field.
network
craftcms CWE-79
4.3
2019-07-26 CVE-2019-14280 Information Exposure vulnerability in Craftcms Craft CMS
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.
network
low complexity
craftcms CWE-200
5.0