Known vulnerabilities in Craft CMS - page 4

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 142
Public exploits: 13
Known exploited (KEV): 4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 142 known vulnerabilities: 1 critical, 13 high, 54 medium, 74 low Critical High Medium Low

Vulnerabilities (142)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU84988 - Permissions, Privileges, and Access Controls
CWE-264 High
No
No
3.9.10 04.01.2024 SB2024010422
#VU84933 - Permissions, Privileges, and Access Controls
CVE-2024-21622
CWE-264 Medium
No
No
3.9.6, 4.5.16 03.01.2024 SB2024010314
#VU82198 - Improper input validation
CWE-20 High
No
No
3.9.5, 4.5.7 18.10.2023 SB2023101838
#VU80806 - Improper Access Control
CVE-2023-41892
CWE-284 High
Available
No
4.4.15 14.09.2023 SB2023091461
#VU79808 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-40035
CWE-22 Low
No
No
3.8.15, 4.4.15 21.08.2023 SB20230821232
#VU79362 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
3.8.17, 4.4.17 10.08.2023 SB2023081020
#VU78376 - Improper input validation
CWE-20 High
No
No
3.8.16, 4.4.16 19.07.2023 SB2023071928
#VU77914 - Improper input validation
CWE-20 High
No
No
3.8.15, 4.4.15 03.07.2023 SB2023070401
#VU76598 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-33194
CWE-79 Low
No
No
3.8.6, 4.4.6 29.05.2023 SB2023052913
#VU76597 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-33195
CWE-79 Low
No
No
4.4.6 29.05.2023 SB2023052913
#VU76596 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-33197
CWE-79 Low
No
No
4.4.6 29.05.2023 SB2023052913
#VU76584 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-33196
CWE-79 Low
No
No
4.4.7 26.05.2023 SB2023052639
#VU76399 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-2817
CWE-79 Low
No
No
4.4.11 22.05.2023 SB2023052206
#VU76378 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-32679
CWE-94 Medium
No
No
4.4.6 19.05.2023 SB2023051932
#VU73794 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-23927
CWE-79 Low
No
No
4.3.7 20.03.2023 SB2023032001
#VU57058 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-41824
CWE-94 Medium
No
No
3.7.14 05.10.2021 SB2021100510
#VU54558 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-27902
CWE-79 Low
No
No
3.6.0 05.07.2021 SB2021070515
#VU54557 - Session Fixation
CVE-2021-27903
CWE-384 High
No
No
3.6.7 05.07.2021 SB2021070514
#VU53291 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-32470
CWE-79 Low
No
No
3.6.13 17.05.2021 SB2021051701
#VU36272 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-20418
CWE-79 Low
Available
No
- 24.12.2018 SB2018122412


Showing elements 61 - 80 out of 142