CVE-2025-32432-exploit-by-P34NUT

CVE-2025-32432 — Эксплойт Pre-Auth RCE в Craft CMS Автор: P34NUT2 Уязвимость: Удалённое выполнение кода до аутентификации в Craft CMS CVE: CVE-2025-32432 Цель: Любой уязвимый экземпляр Craft CMS 3.x / 4.x / 5.x — протестировано на Hack The Box: Orion ⚠️ Отказ от ответственности Этот инструмент...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2026-31857: Craft CMS control panel RCE CVE-2026-31857 is...

Compression Footprints As Security Signals for Model-Poisoning Defense in Federated Learning

Lossy compression is widely used in Federated Learning FL but is generally treated as an error source, while conventional poisoning defenses inspect update geometry. In this work, we instead treat the compressor's response as a security signal: the input-dependent distortion and payload behavior...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2026-31857 - CraftCMS RCE exploit Python exploit for a RC...

Exploit for CVE-2026-44011

CVE-2026-44011 Authenticated RCE in Craft CMS via Yii behavio...

CVE-2025-32432

CVE-2025-32432 — Craft CMS = 5.6.16 Unauthenticated RCE Severity: Critical CVSS 10.0 Auth required: None Affected: Craft CMS 3.0.0-RC1 - 3.9.14, 4.0.0-RC1 - 4.14.14, 5.0.0-RC1 - 5.6.16 Patched in: Craft CMS 3.9.15 / 4.14.15 / 5.6.17, Yii2 2.0.50 Identify How to Confirm the Target is Vulnerable...

Exploit for CVE-2026-44011

CVE-2026-44011: Craft CMS authenticated RCE PoC This Python s...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Craftcms Craft_Cms

CVE-2026-28695 Patch Bypass - Craft CMS Blind RCE Authenticat...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Craftcms Craft_Cms

CVE-2026-28695 patch bypass — Craft CMS ≤ 5.9.8 authenticated RC...

GHSA-9RG8-2WVR-FGJH Formie: Missing authorization on sent notification resend modal exposes submission PII

Impact The control panel action formie/sent-notifications/get-resend-modal-content SentNotificationsController::actionGetResendModalContent performed only requireAcceptsJson and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user...

Formie: Missing authorization on sent notification resend modal exposes submission PII

Impact The control panel action formie/sent-notifications/get-resend-modal-content SentNotificationsController::actionGetResendModalContent performed only requireAcceptsJson and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user...

CVE-2026-76089

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-76086

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-76087

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Impact The anonymous front-end action formie/submissions/submit SubmissionsController::actionSubmit trusted a client-supplied submissionId when loading an incomplete submission, with no session binding, ownership check, or edit token validation. An unauthenticated attacker could enumerate...

CVE-2026-76087 Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

CVE-2026-76087 Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

EUVD-2026-85547

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

CVE-2026-76087

The Formie Craft CMS plugin (prior to versions 2.2.23 and 3.1.31 ) contains an authorization bypass in the anonymous formie/submissions/submit action (SubmissionsController::actionSubmit). The component fails to perform session binding, ownership validation, or submissionEditToken verification wh...

CVE-2026-76087 Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...