Vulnerabilities > Craftercms > Crafter CMS

DATE CVE VULNERABILITY TITLE RISK
2023-02-17 CVE-2023-26020 SQL Injection vulnerability in Craftercms Crafter CMS
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.
network
low complexity
craftercms CWE-89
7.2
2022-09-13 CVE-2022-40634 Improper Control of Dynamically-Managed Code Resources vulnerability in Craftercms Crafter CMS
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
network
low complexity
craftercms CWE-913
7.2
2022-09-13 CVE-2022-40635 Improper Control of Dynamically-Managed Code Resources vulnerability in Craftercms Crafter CMS
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
network
low complexity
craftercms CWE-913
7.2
2022-05-16 CVE-2021-23265 Unspecified vulnerability in Craftercms Crafter CMS
A logged-in and authenticated user with a Reviewer Role may lock a content item.
network
low complexity
craftercms
4.3
2022-05-16 CVE-2021-23266 Improper Encoding or Escaping of Output vulnerability in Craftercms Crafter CMS
An anonymous user can craft a URL with text that ends up in the log viewer as is.
network
low complexity
craftercms CWE-116
4.3
2022-05-16 CVE-2021-23267 Improper Control of Dynamically-Managed Code Resources vulnerability in Craftercms Crafter CMS
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.
network
low complexity
craftercms CWE-913
8.8
2021-12-02 CVE-2021-23258 Improper Control of Dynamically-Managed Code Resources vulnerability in Craftercms Crafter CMS
Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans.
network
low complexity
craftercms CWE-913
7.2
2021-12-02 CVE-2021-23259 Improper Control of Dynamically-Managed Code Resources vulnerability in Craftercms Crafter CMS
Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage.
network
low complexity
craftercms CWE-913
7.2
2021-12-02 CVE-2021-23260 Cross-site Scripting vulnerability in Craftercms Crafter CMS
Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
network
low complexity
craftercms CWE-79
5.4
2021-12-02 CVE-2021-23261 Unspecified vulnerability in Craftercms Crafter CMS
Authenticated administrators may override the system configuration file and cause a denial of service.
network
low complexity
craftercms
4.9