3043 matches found
CVE-2026-105985
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-44011-poc
CVE-2026-44011 Yii behavior 주입을 통한 Craft CMS의 인증된 RCE. 영향받는 버전: 4.0.0–4.17.11, 5.0.0–5.9.17 수정된 버전: 4.17.12, 5.9.18 권고문: GHSA-qrgm-p9w5-rrfw 취약점 /admin/actions/element-search/search 엔드포인트는 condition 파라미터를 받아들이며, 이는 Component::cleanseConfig가 먼저 호출되지 않은 채 ElementCondition::createCondition으로 직접 전달됩니...
CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
EUVD-2026-93362
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-105985
Craft CMS 5.10.13.2 is vulnerable to authenticated remote code execution (RCE) within the Control Panel's app/render-components action. An authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides to manipulate an EntryType object's ...
CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2023-41892_PoC
CVE-2023-41892 Craft CMS PoC Этот репозиторий содержит скрипты proof-of-concept и локальный Vulhub-стенд для воспроизведения CVE-2023-41892 — уязвимости удаленного выполнения кода без предварительной аутентификации в Craft CMS. Используйте этот проект только в авторизованной локальной лаборатории...
PT-2026-106708
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
Exploit for Code Injection in Craftcms Craft_Cms
CVE-2026-31857 — Craft CMS Authenticated RCE Timing PoC A sma...
craft-cms-RCE-CVE-2024-56145
craft-cms-RCE-CVE-2024-56145 CVE-2024-56145 CraftCMS RCE를 위한 POC 랩 환경입니다. 취약점 설명 php.ini에서 registerargcargv 옵션이 활성화된 경우 craftCMS에서 잠재적인 RCE 취약점이 발견되었습니다. 이는 해당 버그를 재현하고 익스플로잇할 수 있는 POC 랩 환경입니다. 버그의 전체 익스플로잇 단계는 Aesstnote Blog에서 확인할 수 있습니다. 랩 설정 일부 파일에 애플리케이션 구성이 포함되어 있으므로, zip 파일이 아닌 전체 저장소를 다운로드...
CraftCMS_CVE-2023-41892
Craft CMS CVE-2023-41892 Существует Удаленное выполнение кода без аутентификации RCE , затрагивающее CraftCMS 4.0.0-RC1 - 4.4.14. Использование python3 craft-cms.py http://target Требования Эксплойт использует requests. Установите его с помощью : python3 -m pip install requests Благодарности...
Craftcms-PoC-CVE-2026-31266
CVE-2026-31266 - Craft CMS: Отсутствие авторизации Информация о CVE Поле| Значение ---|--- CVE ID| CVE-2026-31266 Вендор| Pixel & Tonic Продукт| Craft CMS Затронутые версии| self::ALLOWANONYMOUSLIVE | self::ALLOWANONYMOUSOFFLINE, ; Доказательство концепции With allowAdminChanges=false curl -X POS...
CVE-2025-32432
CVE-2025-32432 — Craft CMS getRequest-getBodyParam'handle'; $...
CVE-2023-41892
CVE-2023-41892 Уязвимость в Craft CMS, которая позволяет удаленное выполнение кода RCE...
CVE-2018-14716
CVE-2018-14716 PoC для CVE-2018-14716 Эксплойт: Craft CMS SEOmatic плагин 3.1.4 - Серверная инъекция шаблонов Дата: 2018-07-20 Ссылка на ПО: https://github.com/nystudio107/craft-seomatic Автор эксплойта: Sebastian Kriesten 0xB455 Контакт: https://twitter.com/0xB455 CVE: CVE-2018-14716 Категория:...
CVE-2025-32432
CVE-2025-32432 — Craft CMS Pre-Auth RCE Эксплойт для удалённого выполнения кода без аутентификации в Craft CMS, написанный на Go. Вдохновлён оригинальной работой c0gnit00. Как это работает 1. Получает PHP-сессию и CSRF-токен через GET /admin/login 2. Отравляет файл PHP-сессии, внедряя PHP-код в...
CVE-2025-32432
CVE-2025-32432 - Craft CMS 무인증 RCE PoC CVE-2025-32432 에 대한 동작하는 개념 증명PoC으로, Craft CMS 5.6.16 이하 버전에 영향을 주는 무인증 원격 코드 실행RCE 취약점입니다 동등한 코드 경로의 4.x 및 3.x 트리에도 영향을 줍니다. 검색 키워드: CVE-2025-32432, Craft CMS RCE, Craft 5.6.16 exploit, Yii2 PhpManager gadget, craftcms generate-transform, Component::set as...
CVE-2023-36123
CVE-2023-36123 Только для демонстрационных целей. Эксплойт работает на всех версиях Plain Craft Launcher 2. Скачайте Custom.xaml и импортируйте его в Plain Craft Launcher 2, затем нажмите "Run Command". https://github.com/Hex-Dragon/PCL2/assets/140469824/636d1436-a26d-4f54-ad4f-a7b1bb123783...