Skip to content
Noroxi

CrafterCMS records

27 published records for vendor craftercms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
70.4%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 20
  3. 21
  4. 22
  5. 23
  6. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

27 records
  • CVE-2017-15681
    40Plan

    In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files fro

    CriticalCVSS 9.8No exploitEPSS 2%

    craftercms · crafter cmsNov 27, 2020

  • CVE-2018-19907
    36Monitor

    A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18.

    HighCVSS 8.8No exploitEPSS 2%

    craftercms · crafter cmsDec 6, 2018

  • CVE-2021-23264
    36Monitor

    Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter Search

    CriticalCVSS 9.1No exploitEPSS 1%

    craftercms · crafter cmsDec 2, 2021

  • CVE-2017-15685
    35Monitor

    Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE).

    HighCVSS 8.6No exploitEPSS 2%

    craftercms · crafter cmsNov 27, 2020

  • CVE-2021-23267
    35Monitor

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    HighCVSS 8.8No exploitEPSS 1%

    craftercms · crafter cmsMay 16, 2022

  • CVE-2017-15683
    34Monitor

    In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieva

    HighCVSS 8.6No exploitEPSS 2%

    craftercms · crafter cmsNov 27, 2020

  • CVE-2017-15684
    31Monitor

    Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the opera

    HighCVSS 7.5No exploitEPSS 2%

    craftercms · crafter cmsNov 27, 2020

  • CVE-2021-23263
    31Monitor

    Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine

    HighCVSS 7.5No exploitEPSS 2%

    craftercms · crafter cmsDec 2, 2021

  • CVE-2025-6384
    29Monitor

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    HighCVSS 7.3Proof of conceptEPSS 1%

    craftercms · craftercmsJun 19, 2025

  • CVE-2022-40635
    28Monitor

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    HighCVSS 7.2Proof of conceptEPSS 2%

    craftercms · crafter cmsSep 13, 2022

  • CVE-2022-40634
    28Monitor

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    HighCVSS 7.2Proof of conceptEPSS 2%

    craftercms · crafter cmsSep 13, 2022

  • CVE-2020-25803
    28Monitor

    Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.

    HighCVSS 7.2No exploitEPSS 1%

    craftercms · studioOct 6, 2020

  • CVE-2020-25802
    28Monitor

    Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.

    HighCVSS 7.2No exploitEPSS 1%

    craftercms · studioOct 6, 2020

  • CVE-2021-23258
    28Monitor

    Spring SPEL Expression Language Injection

    HighCVSS 7.2No exploitEPSS 1%

    craftercms · crafter cmsDec 2, 2021

  • CVE-2021-23259
    28Monitor

    Groovy Sandbox Bypass

    HighCVSS 7.2No exploitEPSS 1%

    craftercms · crafter cmsDec 2, 2021

  • CVE-2021-23262
    28Monitor

    Snakeyaml deserialization vulnerability bypass

    HighCVSS 7.2No exploitEPSS 1%

    craftercms · crafter cmsDec 2, 2021

  • CVE-2023-26020
    28Monitor

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Crafter Studio

    HighCVSS 7.2No exploitEPSS 0%

    linux · linux kernelFeb 17, 2023

  • CVE-2025-0502
    27Monitor

    Transmission of Private Resources into a New Sphere in Crafter Engine

    MediumCVSS 6.9No exploitEPSS 0%

    craftercms · craftercmsJan 15, 2025

  • CVE-2017-15680
    26Monitor

    In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative da

    MediumCVSS 6.5No exploitEPSS 1%

    craftercms · crafter cmsNov 27, 2020

  • CVE-2023-4136
    24Monitor

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

    MediumCVSS 6.1Proof of conceptEPSS 1%

    craftercms · craftercmsAug 3, 2023

  • CVE-2017-15686
    24Monitor

    Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.

    MediumCVSS 6.1No exploitEPSS 1%

    craftercms · crafter cmsNov 27, 2020

  • CVE-2017-15682
    24Monitor

    In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS

    MediumCVSS 6.1No exploitEPSS 1%

    craftercms · crafter cmsNov 27, 2020

  • CVE-2021-23260
    21Monitor

    Stored XSS Vulnerability in File Name of the File Upload function

    MediumCVSS 5.4No exploitEPSS 0%

    craftercms · crafter cmsDec 2, 2021

  • CVE-2021-23261
    19Monitor

    Overriding the system configuration file causes a denial of service

    MediumCVSS 4.9No exploitEPSS 1%

    craftercms · crafter cmsDec 2, 2021

  • CVE-2023-33194
    19Monitor

    CraftCMS stored XSS in Quick Post widget error message

    MediumCVSS 4.8No exploitEPSS 1%

    craftcms · craft cmsMay 26, 2023