Security
فارسی
All products

craftcms/cms

Composer · Package
127 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()CVE-2026-32267 · GHSA-CC7P-2J3X-X7XF craftcms/cms Composer High Fix reported
Craft CMS: Stored XSS via Structure entry title in table viewCVE-2026-55793 · GHSA-XRQC-P465-2XVG craftcms/cms Composer Medium Fix reported
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elementsCVE-2026-50281 · GHSA-X5M4-G2CQ-52PQ craftcms/cms Composer High Fix reported
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced MovesCVE-2026-50282 · GHSA-3W32-23WJ-RXG3 craftcms/cms Composer High Fix reported
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save checkCVE-2026-50280 · GHSA-43CQ-C2GQ-PFPW craftcms/cms Composer Medium Fix reported
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widgetCVE-2026-55790 · GHSA-24X4-J6X9-RFW5 craftcms/cms Composer High Fix reported
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsCVE-2026-55791 · GHSA-C55V-343G-5XFF craftcms/cms Composer Critical Fix reported
Craft CMS: Unauthorized Deletion of Source Assets During File ReplacementCVE-2026-50283 · GHSA-QH45-9G5P-M2V4 craftcms/cms Composer Medium Fix reported
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gapCVE-2026-50279 · GHSA-QQ2C-2Q8J-JH27 craftcms/cms Composer High Fix reported
Craft CMS: Potential authenticated Remote Code Execution via referrer redirectCVE-2026-55794 · GHSA-F74W-488G-8X5R craftcms/cms Composer High Fix reported
Craft CMS: Sensitive File Disclosure / Server-Side File ReadCVE-2026-55792 · GHSA-287W-MXQ6-X2CP craftcms/cms Composer Medium Fix reported
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assetsCVE-2026-50284 · GHSA-7H62-6V23-V8FM craftcms/cms Composer High Fix reported
Craft CMS Arbitrary System File ReadCVE-2024-52292 · GHSA-CW6G-QMJQ-6W2W craftcms/cms Composer High Fix reported
Craft CMS Allows TOTP Token To Stay Valid After UseCVE-2024-41800 · GHSA-WMX7-PW49-88JX craftcms/cms Composer Medium Fix reported
Craft CMS Feed-MeCVE-2023-36260 · GHSA-6P78-F7H9-6838 craftcms/cms Composer High Fix reported
Craft CMS vulnerable to Remote Code Execution via unrestricted file extension CVE-2023-32679 · GHSA-VQXF-R9PH-CC9C craftcms/cms Composer High Fix reported
Craft CMS vulnerable to Remote Code Execution via validatePath bypassCVE-2023-40035 · GHSA-44WR-RMWQ-3PHW craftcms/cms Composer High Fix reported
Craft CMS vulnerable to HTML injectionCVE-2023-33495 · GHSA-M3V5-GJJ9-RG24 craftcms/cms Composer Medium No fix reported
Craft CMS XSS in RSS widget feedCVE-2023-33195 · GHSA-QPGM-GJGF-8C2X craftcms/cms Composer Medium Fix reported
Craft CMS Privilege EscalationCVE-2024-21622 · GHSA-J5G9-J7R4-6QVX craftcms/cms Composer Medium Fix reported