İçeriğe atla
Noroxi

craftcms kayıtları

craftcms üreticisine ait 114 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
4 · %3,5
Silahlaştırılmış
5 · %4,4
Pre-auth RCE
8
Düzeltme kaydı olan
%93
Yayından KEV’e ortanca
100 gün

Yıllara göre kayıt

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

114 kayıt
  • CVE-2025-32432
    100Hemen

    Craft CMS Allows Remote Code Execution

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %100

    craftcms · craft cms25 Nis 2025

  • CVE-2024-56145
    96Hemen

    RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %97

    craftcms · craft cms18 Ara 2024

  • CVE-2025-23209
    69Bu hafta

    Potential RCE with a compromised security key in craft/cms

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %22

    craftcms · craft cms17 Oca 2025

  • CVE-2023-41892
    67Bu hafta

    Craft CMS Remote Code Execution vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %94

    craftcms · craft cms13 Eyl 2023

  • CVE-2020-9757
    61Bu hafta

    The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacont

    KritikCVSS 9,8Kavram kanıtıEPSS %73

    craftcms · craft cms4 Mar 2020

  • CVE-2025-35939
    57Planlayın

    Craft CMS stores user-provided content in session files

    OrtaCVSS 6,9KEVSilahlaştırılmışEPSS %1

    craftcms · craft cms7 May 2025

  • CVE-2024-37843
    55Planlayın

    Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

    KritikCVSS 9,8Kavram kanıtıEPSS %53

    craftcms · craft cms25 Haz 2024

  • CVE-2021-27903
    40Planlayın

    An issue was discovered in Craft CMS before 3.6.7.

    KritikCVSS 9,8İstismar yokEPSS %3

    craftcms · craft cms30 Haz 2021

  • CVE-2019-15929
    40Planlayın

    In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibil

    KritikCVSS 9,8İstismar yokEPSS %2

    craftcms · craft cms24 Eki 2019

  • CVE-2026-28697
    37İzleyin

    Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates

    KritikCVSS 9,4İstismar yokEPSS %1

    craftcms · craft cms4 Mar 2026

  • CVE-2026-28783
    37İzleyin

    Craft has a Twig Function Blocklist Bypass

    KritikCVSS 9,4İstismar yokEPSS %1

    craftcms · craft cms4 Mar 2026

  • CVE-2022-29933
    36İzleyin

    Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password an

    YüksekCVSS 8,8İstismar yokEPSS %5

    craftcms · craft cms9 May 2022

  • CVE-2018-3814
    36İzleyin

    Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it

    YüksekCVSS 8,8İstismar yokEPSS %2

    craftcms · craft cms1 Oca 2018

  • CVE-2023-30130
    35İzleyin

    An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.

    YüksekCVSS 8,8İstismar yokEPSS %1

    craftcms · craft cms12 May 2023

  • CVE-2021-41824
    35İzleyin

    Craft CMS before 3.7.14 allows CSV injection.

    YüksekCVSS 8,8İstismar yokEPSS %1

    craftcms · craft cms29 Eyl 2021

  • CVE-2024-21622
    35İzleyin

    Craft CMS Privilege Escalation

    YüksekCVSS 8,8İstismar yokEPSS %1

    craftcms · craft cms3 Oca 2024

  • CVE-2026-25498
    34İzleyin

    Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

    YüksekCVSS 8,6İstismar yokEPSS %1

    craftcms · craft cms9 Şub 2026

  • CVE-2026-33157
    34İzleyin

    Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

    YüksekCVSS 8,6İstismar yokEPSS %1

    craftcms · craft cms24 Mar 2026

  • CVE-2025-68455
    34İzleyin

    Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

    YüksekCVSS 8,6İstismar yokEPSS %1

    craftcms · craft cms5 Oca 2026

  • CVE-2026-32264
    34İzleyin

    Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

    YüksekCVSS 8,6İstismar yokEPSS %1

    craftcms · craft cms16 Mar 2026

  • CVE-2026-32263
    34İzleyin

    Craft CMS vulnerable to behavior injection RCE via EntryTypesController

    YüksekCVSS 8,6İstismar yokEPSS %1

    craftcms · craft cms16 Mar 2026

  • CVE-2026-28784
    34İzleyin

    Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

    YüksekCVSS 8,6İstismar yokEPSS %1

    craftcms · craft cms4 Mar 2026

  • CVE-2026-25495
    34İzleyin

    Craft has a SQL Injection in Element Indexes via criteria[orderBy]

    YüksekCVSS 8,7İstismar yokEPSS %1

    craftcms · craft cms9 Şub 2026

  • CVE-2026-25497
    34İzleyin

    Craft has a GraphQL Asset Mutation Privilege Escalation

    YüksekCVSS 8,6İstismar yokEPSS %1

    craftcms · craft cms9 Şub 2026

  • CVE-2026-29174
    34İzleyin

    Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting

    YüksekCVSS 8,7İstismar yokEPSS %1

    craftcms · craft commerce10 Mar 2026