payloadcms kayıtları

payloadcms üreticisine ait 11 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren: 0 · %0
Silahlaştırılmış: 0 · %0
Pre-auth RCE: 1
Düzeltme kaydı olan: %100
Yayından KEV’e ortanca: KEV’e giren kayıt yok

Yıllara göre kayıt

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

Saldırı profili

Tüm kayıtlar

11 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
40Planlayın	CVE-2022-27952İstismar yok	An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafpayloadcms · payload · CWE-434 pre-auth RCE Dosya yükleme	Kritik9,8	—	%2,3	12 Nis 2022
39İzleyin	CVE-2026-25544Kavram kanıtı	Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapterspayloadcms · payload · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,8	—	%0,9	6 Şub 2026
36İzleyin	CVE-2026-34751İstismar yok	Payload has Unvalidated Input in Password Recovery Endpointspayloadcms · payload · CWE-472 Kimlik doğrulamasız	Kritik9,1	—	%0,4	1 Nis 2026
34İzleyin	CVE-2026-34748İstismar yok	@payloadcms/next has Stored XSS in Admin Panelpayloadcms · payload · CWE-79 XSS	Yüksek8,7	—	%0,4	1 Nis 2026
32İzleyin	CVE-2026-34747İstismar yok	Payload has an SQL Injection via Query Handlingpayloadcms · payload · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek8,2	—	%0,4	1 Nis 2026
30İzleyin	CVE-2026-34746İstismar yok	Payload has Authenticated SSRF via Upload Functionalitypayloadcms · payload · CWE-918 SSRF	Yüksek7,7	—	%0,4	1 Nis 2026
26İzleyin	CVE-2023-30843İstismar yok	Payload's hidden fields can be leaked on readable collectionspayloadcms · payload · CWE-200 Bilgi sızıntısı	Orta6,5	—	%0,6	26 Nis 2023
26İzleyin	CVE-2026-34750İstismar yok	Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpointspayloadcms · payload · CWE-22 Yol geçişi	Orta6,5	—	%0,4	1 Nis 2026
21İzleyin	CVE-2026-25574İstismar yok	Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)payloadcms · payload · CWE-639 Erişim denetimi (IDOR)	Orta5,4	—	%0,2	6 Şub 2026
21İzleyin	CVE-2026-34749İstismar yok	Payload has a CSRF Protection Bypass in Authentication Flowpayloadcms · payload · CWE-352 Kimlik doğrulamasız CSRF	Orta5,4	—	%0,2	1 Nis 2026
19İzleyin	CVE-2026-27567İstismar yok	Payload has Server-Side Request Forgery (SSRF) in External File URL Uploadspayloadcms · payload · CWE-918 SSRF	Orta4,8	—	%0,4	24 Şub 2026

CVE-2022-27952
40Planlayın
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a craf
KritikCVSS 9,8İstismar yokEPSS %2
- pre-auth RCE
- Dosya yükleme
payloadcms · payload12 Nis 2022
CVE-2026-25544
39İzleyin
Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
KritikCVSS 9,8Kavram kanıtıEPSS %1
- Kimlik doğrulamasız
- SQL enjeksiyonu
payloadcms · payload6 Şub 2026
CVE-2026-34751
36İzleyin
Payload has Unvalidated Input in Password Recovery Endpoints
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
payloadcms · payload1 Nis 2026
CVE-2026-34748
34İzleyin
@payloadcms/next has Stored XSS in Admin Panel
YüksekCVSS 8,7İstismar yokEPSS %0
- XSS
payloadcms · payload1 Nis 2026
CVE-2026-34747
32İzleyin
Payload has an SQL Injection via Query Handling
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
payloadcms · payload1 Nis 2026
CVE-2026-34746
30İzleyin
Payload has Authenticated SSRF via Upload Functionality
YüksekCVSS 7,7İstismar yokEPSS %0
- SSRF
payloadcms · payload1 Nis 2026
CVE-2023-30843
26İzleyin
Payload's hidden fields can be leaked on readable collections
OrtaCVSS 6,5İstismar yokEPSS %1
- Bilgi sızıntısı
payloadcms · payload26 Nis 2023
CVE-2026-34750
26İzleyin
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
OrtaCVSS 6,5İstismar yokEPSS %0
- Yol geçişi
payloadcms · payload1 Nis 2026
CVE-2026-25574
21İzleyin
Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)
OrtaCVSS 5,4İstismar yokEPSS %0
- Erişim denetimi (IDOR)
payloadcms · payload6 Şub 2026
CVE-2026-34749
21İzleyin
Payload has a CSRF Protection Bypass in Authentication Flow
OrtaCVSS 5,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
payloadcms · payload1 Nis 2026
CVE-2026-27567
19İzleyin
Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads
OrtaCVSS 4,8İstismar yokEPSS %0
- SSRF
payloadcms · payload24 Şub 2026