Advisories for packages from craftcms

Listing reported advisories for packages from craftcms sorted by their report date.

Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.21

2026-03-11 14:57:00
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
GitHub

craftcms/cms

>= 4.0.0-beta.1, <= 4.17.3 · >= 5.0.0-RC1, <= 5.9.8

2026-03-11 14:56:47
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.8

2026-03-11 00:27:24
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
GitHub

craftcms/cms

>= 4.15.3, <= 4.17.2 · >= 5.7.5, <= 5.9.6

2026-03-11 00:26:14
Craft Commerce: Potential IDOR in Commerce carts
GitHub

craftcms/commerce

>= 4.0.0, < 4.11.0 · >= 5.0.0, < 5.6.0

2026-03-10 18:24:50
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.1 · >= 5.0.0, <= 5.5.2

2026-03-10 18:24:20
Craft Commerce has stored XSS in Inventory Location Name
GitHub

craftcms/commerce

>= 5.0.0, <= 5.5.2

2026-03-10 18:24:00
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
GitHub

craftcms/commerce

>= 5.0.0, <= 5.5.2

2026-03-10 18:23:43
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
GitHub

craftcms/commerce

>= 5.0.0, <= 5.5.2

2026-03-10 18:23:27
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.1 · >= 5.0.0, <= 5.5.2

2026-03-10 18:23:18
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.1 · >= 5.0.0, <= 5.5.2

2026-03-10 18:23:08
Craft CMS has a potential information disclosure vulnerability in preview tokens
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.3 · >= 5.0.0-RC1, < 5.9.6

2026-03-10 18:22:03
Craft CMS has unauthenticated activation email trigger with potential user enumeration
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.2 · >= 5.0.0-RC1, < 5.9.0-beta.2

2026-03-04 20:52:32
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 21:06:45
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 21:05:15
Craft CMS has Twig Function Blocklist Bypass
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 21:01:30
Craft CMS: Entries Authorship Spoofing via Mass Assignment
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 21:00:55
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 21:00:20
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 20:58:09
Craft CMS has IDOR via GraphQL @parseRefs
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 20:38:57
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.8.7, < 5.9.0-beta.1

2026-03-03 20:30:37
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type
GitHub

craftcms/cms

>= 4.5.0-beta.1, <= 4.16.18 · >= 5.0.0-RC1, <= 5.8.22

2026-02-25 19:11:33
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.22 · >= 3.5.0, <= 4.16.18

2026-02-24 15:51:09
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
GitHub

craftcms/cms

>= 4.5.0-RC1, <= 4.16.18 · >= 5.0.0-RC1, <= 5.8.22

2026-02-23 22:16:24
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.22 · >= 3.5.0, <= 4.16.18

2026-02-23 22:16:04
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
GitHub

craftcms/cms

>= 4.5.0-RC1, <= 4.16.18 · >= 5.0.0-RC1, <= 5.8.22

2026-02-23 22:15:05
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.17 · >= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:36:44
Craft CMS: GraphQL Asset Mutation Privilege Escalation
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-02-09 20:36:26
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.17 · >= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:35:48
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.17 · >= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:35:43
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.17 · >= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:35:36
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.17 · >= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:35:31
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
GitHub

craftcms/craft

>= 5.0.0-RC1, <= 5.8.21 · >= 3.5.0, <= 4.16.17

2026-02-09 20:35:24
Craft CMS Vulnerable to Stored XSS in Entry Types Name
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:35:11
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 23:04:01
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 23:02:34
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 23:00:13
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:51:52
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:51:17
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:49:55
Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
GitHub

craftcms/composer

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:45:03
Craft Commerce has Stored XSS in Product Type Name
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0, <= 5.5.1

2026-02-02 22:44:05
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0, <= 5.5.1

2026-02-02 22:43:01
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0, <= 5.5.1

2026-02-02 22:41:44
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.16 · >= 5.0.0-RC1, <= 5.8.20

2026-01-05 18:50:15
Unauthenticated Craft CMS users can trigger a database backup
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.20 · >= 3.0.0, <= 4.16.16

2026-01-05 18:49:58
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.16 · >= 5.0.0-RC1, <= 5.8.20

2026-01-05 18:10:57
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.20 · >= 3.5.0, <= 4.16.16

2026-01-05 18:02:39
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.16 · >= 5.0.0-RC1, <= 5.8.20

2026-01-05 17:42:32
Craft CMS Potential Remote Code Execution via Twig SSTI
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.5 · >= 5.0.0-RC1, <= 5.8.6

2025-08-25 20:42:45
« Previous Next »

Showing 1 to 50 of 102 results

1 2 3