Skip to content
Noroxi

craftcms records

114 published records for vendor craftcms.

Researcher profile

Entered KEV
4 · 3.5%
Weaponized
5 · 4.4%
Pre-auth RCE
8
With a fix record
93%
Median publish → KEV
100 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

114 records
  • CVE-2025-32432
    100Now

    Craft CMS Allows Remote Code Execution

    CriticalCVSS 10.0KEVWeaponizedEPSS 100%

    craftcms · craft cmsApr 25, 2025

  • CVE-2024-56145
    96Now

    RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

    CriticalCVSS 9.3KEVWeaponizedEPSS 97%

    craftcms · craft cmsDec 18, 2024

  • CVE-2025-23209
    69This week

    Potential RCE with a compromised security key in craft/cms

    HighCVSS 8.1KEVWeaponizedEPSS 22%

    craftcms · craft cmsJan 17, 2025

  • CVE-2023-41892
    67This week

    Craft CMS Remote Code Execution vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 94%

    craftcms · craft cmsSep 13, 2023

  • CVE-2020-9757
    61This week

    The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacont

    CriticalCVSS 9.8Proof of conceptEPSS 73%

    craftcms · craft cmsMar 4, 2020

  • CVE-2025-35939
    57Plan

    Craft CMS stores user-provided content in session files

    MediumCVSS 6.9KEVWeaponizedEPSS 1%

    craftcms · craft cmsMay 7, 2025

  • CVE-2024-37843
    55Plan

    Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

    CriticalCVSS 9.8Proof of conceptEPSS 53%

    craftcms · craft cmsJun 25, 2024

  • CVE-2021-27903
    40Plan

    An issue was discovered in Craft CMS before 3.6.7.

    CriticalCVSS 9.8No exploitEPSS 3%

    craftcms · craft cmsJun 30, 2021

  • CVE-2019-15929
    40Plan

    In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibil

    CriticalCVSS 9.8No exploitEPSS 2%

    craftcms · craft cmsOct 24, 2019

  • CVE-2026-28697
    37Monitor

    Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates

    CriticalCVSS 9.4No exploitEPSS 1%

    craftcms · craft cmsMar 4, 2026

  • CVE-2026-28783
    37Monitor

    Craft has a Twig Function Blocklist Bypass

    CriticalCVSS 9.4No exploitEPSS 1%

    craftcms · craft cmsMar 4, 2026

  • CVE-2022-29933
    36Monitor

    Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password an

    HighCVSS 8.8No exploitEPSS 5%

    craftcms · craft cmsMay 9, 2022

  • CVE-2018-3814
    36Monitor

    Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it

    HighCVSS 8.8No exploitEPSS 2%

    craftcms · craft cmsJan 1, 2018

  • CVE-2023-30130
    35Monitor

    An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.

    HighCVSS 8.8No exploitEPSS 1%

    craftcms · craft cmsMay 12, 2023

  • CVE-2021-41824
    35Monitor

    Craft CMS before 3.7.14 allows CSV injection.

    HighCVSS 8.8No exploitEPSS 1%

    craftcms · craft cmsSep 29, 2021

  • CVE-2024-21622
    35Monitor

    Craft CMS Privilege Escalation

    HighCVSS 8.8No exploitEPSS 1%

    craftcms · craft cmsJan 3, 2024

  • CVE-2026-25498
    34Monitor

    Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

    HighCVSS 8.6No exploitEPSS 1%

    craftcms · craft cmsFeb 9, 2026

  • CVE-2026-33157
    34Monitor

    Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

    HighCVSS 8.6No exploitEPSS 1%

    craftcms · craft cmsMar 24, 2026

  • CVE-2025-68455
    34Monitor

    Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

    HighCVSS 8.6No exploitEPSS 1%

    craftcms · craft cmsJan 5, 2026

  • CVE-2026-32264
    34Monitor

    Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

    HighCVSS 8.6No exploitEPSS 1%

    craftcms · craft cmsMar 16, 2026

  • CVE-2026-32263
    34Monitor

    Craft CMS vulnerable to behavior injection RCE via EntryTypesController

    HighCVSS 8.6No exploitEPSS 1%

    craftcms · craft cmsMar 16, 2026

  • CVE-2026-28784
    34Monitor

    Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

    HighCVSS 8.6No exploitEPSS 1%

    craftcms · craft cmsMar 4, 2026

  • CVE-2026-25495
    34Monitor

    Craft has a SQL Injection in Element Indexes via criteria[orderBy]

    HighCVSS 8.7No exploitEPSS 1%

    craftcms · craft cmsFeb 9, 2026

  • CVE-2026-25497
    34Monitor

    Craft has a GraphQL Asset Mutation Privilege Escalation

    HighCVSS 8.6No exploitEPSS 1%

    craftcms · craft cmsFeb 9, 2026

  • CVE-2026-29174
    34Monitor

    Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting

    HighCVSS 8.7No exploitEPSS 1%

    craftcms · craft commerceMar 10, 2026