Known Vulnerabilities for products from Craftcms
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Craftcms".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-29113 json | Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoi... | Not Provided | 2026-03-10 | 2026-09-02 |
| CVE-2025-68456 json | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauth... | Not Provided | 2026-01-05 | 2026-09-30 |
| CVE-2025-68455 json | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vul... | Not Provided | 2026-01-05 | 2026-09-30 |
| CVE-2025-68454 json | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vul... | Not Provided | 2026-01-05 | 2026-09-30 |
| CVE-2025-68437 json | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the... | Not Provided | 2026-01-05 | 2026-09-30 |
| CVE-2025-68436 json | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, aut... | Not Provided | 2026-01-05 | 2026-09-30 |
| CVE-2025-32432 json | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3... | Not Provided | 2025-04-25 | 2026-09-24 |
| CVE-2024-21622 json | 8.8 - HIGH | 2024-01-03 | 2024-01-10 | |
| CVE-2023-41892 json | Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running ... | 9.8 - CRITICAL | 2023-09-13 | 2023-09-19 |
| CVE-2023-40035 json | Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to... | 7.2 - HIGH | 2023-08-23 | 2023-08-29 |
| CVE-2023-36260 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 7.5 - HIGH | 2024-01-30 | 2024-02-05 |
| CVE-2023-36259 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 5.4 - MEDIUM | 2024-01-30 | 2024-02-05 |
| CVE-2023-33495 json | Craft CMS through 4.4.9 is vulnerable to HTML Injection. | 6.1 - MEDIUM | 2023-06-20 | 2023-11-07 |
| CVE-2023-33197 json | Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update... | 5.4 - MEDIUM | 2023-05-26 | 2023-06-01 |
| CVE-2023-33196 json | Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This i... | 5.4 - MEDIUM | 2023-05-26 | 2023-06-02 |
| CVE-2023-33195 json | Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issu... | 6.1 - MEDIUM | 2023-05-27 | 2023-06-02 |
| CVE-2023-33194 json | Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Qui... | 4.8 - MEDIUM | 2023-05-26 | 2023-06-02 |
| CVE-2023-32679 json | Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may l... | 7.2 - HIGH | 2023-05-19 | 2023-05-26 |
| CVE-2023-31144 json | Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title ... | 6.1 - MEDIUM | 2023-05-09 | 2023-05-16 |
| CVE-2023-30179 json | ** DISPUTED ** CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can ... | 7.2 - HIGH | 2023-06-13 | 2023-11-07 |
Known software with vulnerabilities from Craftcms
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Craftcms | Craft Cms | 0.9.0 |