Known vulnerabilities in Craft CMS - page 6

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 137
Public exploits: 13
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 137 known vulnerabilities: 1 critical, 13 high, 50 medium, 73 low Critical High Medium Low

Vulnerabilities (137)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU107991 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-32432
CWE-94 Critical
Available
Exploited
3.9.15, 4.14.15, 5.6.17 28.04.2025 SB2025042834
#VU102307 - Use of Hard-coded Credentials
CVE-2025-23209
CWE-798 High
Available
Exploited
4.13.8, 5.5.8 06.01.2025 SB2025010620
#VU101835 - Exposed Dangerous Method or Function
CVE-2024-56145
CWE-749 High
Available
Exploited
4.13.2, 5.5.2 18.12.2024 SB2024121837
#VU126473 - Improper input validation
CVE-2024-52291
CWE-20 Low
No
No
4.12.5, 5.4.6 13.11.2024 SB2024111363
#VU126474 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-52293
CWE-22 Low
No
No
4.12.2, 5.4.3 13.11.2024 SB2024111362
#VU134650 - Files or Directories Accessible to External Parties
CVE-2024-52292
CWE-552 Low
No
No
4.12.8, 5.4.9 13.11.2024 SB2024111364
#VU126472 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2024-45406
CWE-80 Low
No
No
5.1.2 09.09.2024 SB2024050924
#VU94748 - Insufficient Session Expiration
CVE-2024-41800
CWE-613 Medium
No
No
5.2.3 26.07.2024 SB2024072609
#VU89289 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
5.1.2 09.05.2024 SB2024050924
#VU87179 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
3.9.11, 4.8.1 07.03.2024 SB2024030712
#VU86276 - Incorrect Default Permissions
CVE-2024-24821
CWE-276 Low
No
No
4.7.2.1 08.02.2024 SB2024020870
SB2024021508
SB2024022241
and 3 more
#VU84989 - Permissions, Privileges, and Access Controls
CWE-264 High
No
No
4.5.14 04.01.2024 SB2024010423
#VU84988 - Permissions, Privileges, and Access Controls
CWE-264 High
No
No
3.9.10 04.01.2024 SB2024010422
#VU84933 - Permissions, Privileges, and Access Controls
CVE-2024-21622
CWE-264 Medium
No
No
3.9.6, 4.5.16 03.01.2024 SB2024010314
#VU82198 - Improper input validation
CWE-20 High
No
No
3.9.5, 4.5.7 18.10.2023 SB2023101838
#VU80806 - Improper Access Control
CVE-2023-41892
CWE-284 High
Available
No
4.4.15 14.09.2023 SB2023091461
#VU79808 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-40035
CWE-22 Low
No
No
3.8.15, 4.4.15 21.08.2023 SB20230821232
#VU79362 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
3.8.17, 4.4.17 10.08.2023 SB2023081020
#VU78376 - Improper input validation
CWE-20 High
No
No
3.8.16, 4.4.16 19.07.2023 SB2023071928
#VU77914 - Improper input validation
CWE-20 High
No
No
3.8.15, 4.4.15 03.07.2023 SB2023070401


Showing elements 101 - 120 out of 137