CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-30130
https://notcve.org/view.php?id=CVE-2023-30130
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. • https://craftcms.com https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-31144 – Craft CMS vulnerable to cross site scripting in RSS feed widget
https://notcve.org/view.php?id=CVE-2023-31144
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4. • https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442 https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30177
https://notcve.org/view.php?id=CVE-2023-30177
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name. • https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2023-23927 – Craft CMS stored cross-site scripting vulnerability
https://notcve.org/view.php?id=CVE-2023-23927
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7. • https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03 https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-37783
https://notcve.org/view.php?id=CVE-2022-37783
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework. Todas las versiones de Craft CMS entre 3.0.0 y 3.7.32 revelan hashes de contraseñas de usuarios que se autentican utilizando su dirección de correo electrónico o nombre de usuario en tokens Anti-CSRF. Craft CMS utiliza una cookie llamada CRAFT_CSRF_TOKEN y un campo oculto HTML llamado CRAFT_CSRF_TOKEN para evitar ataques de Cross Site Request Forgery. • http://www.openwall.com/lists/oss-security/2024/06/06/1 https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes https://cves.at/posts/cve-2022-37783/writeup • CWE-522: Insufficiently Protected Credentials •