CVSS: 10.0EPSS: 71%CPEs: 1EXPL: 1CVE-2024-37843
https://notcve.org/view.php?id=CVE-2024-37843
25 Jun 2024 — Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. Se descubrió que Craft CMS hasta v3.7.31 contenía una vulnerabilidad de inyección SQL a través del endpoint de la API GraphQL. • https://github.com/gsmith257-cyber/CVE-2024-37843-POC • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36259
https://notcve.org/view.php?id=CVE-2023-36259
30 Jan 2024 — Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation. Una vulnerabilidad de Cross Site Scripting (XSS) en Craft CMS Audit Plugin anterior a la versión 3.0.2 permite a los atacantes ejecutar código arbitrario durante la creación de usuarios. • https://github.com/sjelfull/craft-audit/pull/73 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36260
https://notcve.org/view.php?id=CVE-2023-36260
30 Jan 2024 — An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security." Un probl... • https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33495
https://notcve.org/view.php?id=CVE-2023-33495
20 Jun 2023 — Craft CMS through 4.4.9 is vulnerable to HTML Injection. • https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33197 – Craft CMS stored XSS in indexedVolumes
https://notcve.org/view.php?id=CVE-2023-33197
26 May 2023 — Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6. • https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2817
https://notcve.org/view.php?id=CVE-2023-2817
26 May 2023 — A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively. • https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 10%CPEs: 1EXPL: 2CVE-2023-23927 – Craft CMS stored cross-site scripting vulnerability
https://notcve.org/view.php?id=CVE-2023-23927
03 Mar 2023 — Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7. • https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 3CVE-2022-29933 – Craft CMS 3.7.36 Password Reset Poisoning Attack
https://notcve.org/view.php?id=CVE-2022-29933
06 May 2022 — Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not us... • https://packetstorm.news/files/id/166989 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28378
https://notcve.org/view.php?id=CVE-2022-28378
03 Apr 2022 — Craft CMS before 3.7.29 allows XSS. Craft CMS versiones anteriores a 3.7.29 permite una vulnerabilidad de tipo XSS • https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0CVE-2021-27903
https://notcve.org/view.php?id=CVE-2021-27903
30 Jun 2021 — An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session). Se ha detectado un problema en Craft CMS versiones anteriores a 3.6.7. En algunas circunstancias, se presentaba una potencial vulnerabilidad de ejecución de código remota en sitios que no restringían los cambios administrativos (si un atacante era capaz d... • https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23 • CWE-862: Missing Authorization •