Skip to content
Noroxi

statamic records

30 published records for vendor statamic.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
93.3%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 22
  4. 23
  5. 24
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

30 records
  • CVE-2021-45364
    40Plan

    A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php.

    CriticalCVSS 9.8No exploitEPSS 2%

    statamic · statamicFeb 10, 2022

  • CVE-2023-47129
    39Monitor

    Statamic CMS remote code execution via front-end form uploads

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    statamic · statamicNov 10, 2023

  • CVE-2023-48217
    35Monitor

    Remote code execution via form uploads in statamic/cms

    HighCVSS 8.8No exploitEPSS 1%

    statamic · statamicNov 14, 2023

  • CVE-2017-11422
    35Monitor

    Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called.

    HighCVSS 8.8No exploitEPSS 1%

    statamic · statamicJul 24, 2017

  • CVE-2026-27593
    35Monitor

    Statamic is vulnerable to account takeover via password reset link injection

    HighCVSS 8.8No exploitEPSS 1%

    statamic · statamicFeb 24, 2026

  • CVE-2026-27939
    35Monitor

    Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

    HighCVSS 8.8No exploitEPSS 0%

    statamic · statamicFeb 27, 2026

  • CVE-2026-28423
    34Monitor

    Statamic Vulnerable to Server-Side Request Forgery via Glide

    HighCVSS 8.6No exploitEPSS 0%

    statamic · statamicFeb 27, 2026

  • CVE-2026-25759
    34Monitor

    Statmatic affected by privilege escalation via stored cross-site scripting

    HighCVSS 8.7No exploitEPSS 0%

    statamic · statamicFeb 11, 2026

  • CVE-2026-33172
    34Monitor

    Statamic has Stored XSS via SVG Sanitization Bypass

    HighCVSS 8.7No exploitEPSS 0%

    statamic · statamicMar 20, 2026

  • CVE-2026-28425
    32Monitor

    Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs

    HighCVSS 8.0No exploitEPSS 1%

    statamic · statamicFeb 27, 2026

  • CVE-2026-41175
    32Monitor

    Statamic: Unsafe method invocation via query value resolution allows data destruction

    HighCVSS 8.1No exploitEPSS 1%

    statamic · statamicApr 22, 2026

  • CVE-2026-33882
    26Monitor

    Statamic's Markdown preview endpoint exposes sensitive user data

    MediumCVSS 6.5No exploitEPSS 0%

    statamic · statamicMar 27, 2026

  • CVE-2026-28424
    26Monitor

    Statamic's missing authorization allows access to email addresses

    MediumCVSS 6.5No exploitEPSS 0%

    statamic · statamicFeb 27, 2026

  • CVE-2026-33886
    26Monitor

    Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

    MediumCVSS 6.5No exploitEPSS 0%

    statamic · statamicMar 27, 2026

  • CVE-2024-24570
    24Monitor

    Statamic account takeover via XSS and password reset link

    MediumCVSS 6.1No exploitEPSS 1%

    statamic · statamicFeb 1, 2024

  • CVE-2023-48701
    24Monitor

    Statamic CMS vulnerable to Cross-site Scripting via uploaded assets

    MediumCVSS 6.1No exploitEPSS 1%

    statamic · statamicNov 21, 2023

  • CVE-2026-33885
    24Monitor

    Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

    MediumCVSS 6.1No exploitEPSS 0%

    statamic · statamicMar 27, 2026

  • CVE-2026-33883
    24Monitor

    Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

    MediumCVSS 6.1No exploitEPSS 0%

    statamic · statamicMar 27, 2026

  • CVE-2023-36828
    21Monitor

    Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

    MediumCVSS 5.4No exploitEPSS 1%

    statamic · statamicJul 5, 2023

  • CVE-2024-52600
    21Monitor

    Statamic CMS has Path Traversal in Asset Upload

    MediumCVSS 5.3No exploitEPSS 1%

    statamic · cmsNov 19, 2024

  • CVE-2026-28426
    21Monitor

    Statamic vulnerable to privilege escalation via stored cross-site scripting

    MediumCVSS 5.4No exploitEPSS 0%

    statamic · statamicFeb 27, 2026

  • CVE-2026-32612
    21Monitor

    Statamic: privilege escalation via stored cross-site scripting

    MediumCVSS 5.4No exploitEPSS 0%

    statamic · statamicMar 13, 2026

  • CVE-2026-33887
    21Monitor

    Statamic allows unauthorized content access through missing authorization in its revision controllers

    MediumCVSS 5.4No exploitEPSS 0%

    statamic · statamicMar 27, 2026

  • CVE-2018-19598
    19Monitor

    Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request.

    MediumCVSS 4.8No exploitEPSS 1%

    statamic · statamicDec 19, 2018

  • CVE-2026-27196
    19Monitor

    Statamic affected by privilege escalation via stored Cross-site Scripting

    MediumCVSS 4.8No exploitEPSS 0%

    statamic · statamicFeb 21, 2026