Craftcms · product
cms
148 CVEs · 3 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 3
- check available
- 2
Every one of the 148 is a mark on the map. Named now: 1 to 26, most at risk first.
- CraftCMS - Remote Code Execution
- Craft CMS - Remote Code Execution via Template Path Manipulation
- Potential RCE with a compromised security key in craft/cms
- CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution
- Craft CMS < 4.18.9, < 5.11.2 - Unauthenticated SQL Injection
- Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
- Craft CMS vulnerable to Remote Code Execution via validatePath bypass
- Remote Code Execution via unrestricted file extension in Craft CMS
- Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
- Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI
- Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
- Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates
- Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
- CraftCMS has an RCE vulnerability via relational conditionals in the control panel
- Craft has a potential authenticated Remote Code Execution via malicious attached Behavior
- Authenticated RCE via `condition.config` JSON cleanse bypass
- Craft Potential Remote Code Execution via Twig SSTI
- Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
- Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
- Craft CMS before 5.10.12 Remote Code Execution via element-index
- Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config
- Craft CMS stored cross-site scripting vulnerability
- Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
- Craft Allows Attackers to Read Arbitrary System Files
- Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
- Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.