Time-of-check Time-of-use (TOCTOU) Race Condition

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the getTokenRoute function. An attacker can bypass token usage limits by sending concurrent requests before the database update completes,...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the validateHostname function. An attacker can access internal cloud metadata endpoints and retrieve sensitive credentials by exploiting a...

Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the editableTable.twig component when the html column type is used. An attacker can execute arbitrary JavaScript in the context of another user's session by...

Cross-site Scripting (XSS)

craftcms/commerce is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of the Tax Zone name and description fields, which allows an attacker to inject and execute malicious JavaScript in an administrator’s browser via the admin panel...

SQL Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to SQL Injection via the criteriaorderBy parameter in the JSON body provided to the element-indexes/get-elements endpoint. A user with Control Panel permission can execute SQL commands by...

Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Entry Type Name field in the settings page. An attacker can execute arbitrary JavaScript code in the context of the admin panel by submitting specially crafte...

CVE-2020-37071

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download...

CVE-2020-37071 CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download...

CVE-2020-37071

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download...

CVE-2020-37071 CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download...

CVE-2020-37071

Summary: CVE-2020-37071 affects CraftCMS 3 vCard Plugin 1.0.0 and is a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code via a crafted payload. The attack is triggered by exploiting the plugin’s vCard download functionality with a specially crafted ...

PT-2026-5822

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download...

CVE-2020-37071: Deserialization of Untrusted Data

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download...

CraftCMS 3 vCard Plugin 代码问题漏洞

The CraftCMS 3 vCard Plugin is a vCard generator plugin developed by Nathaniel Hammond. Version 1.0.0 of the CraftCMS 3 vCard Plugin has code vulnerabilities; these vulnerabilities stem from deserialization vulnerabilities, which may allow for the execution of arbitrary PHP code...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name and Description fields in the tax categories section of the admin panel. An attacker can execute arbitrary JavaScript code in the context of an administrator's...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the value.name field in the dashboard widget. An attacker can execute arbitrary JavaScript in the context of an admin user's browser by injecting malicious scripts into...

CVE-2026-25522

creationtimestamp| type| source ---|---|--- 2026-02-02 20:59:20+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-h9r9-2pxg-cx9m...

Improper Access Control

craftcms/cms is vulnerable to Improper Access Control. The vulnerability is due to missing authentication checks on certain administrative actions, which allows an unauthenticated attacker to trigger database backup operations and potentially cause resource exhaustion or information disclosure...

Allocation of Resources Without Limits or Throttling

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling over the /admin/actions/updater/backup endpoint. An unauthenticated user can cause resource exhaustion or access sensitive backup files by...

Server-side Request Forgery (SSRF)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the saveAsset mutation's file input, specifically the url parameter. An attacker can access internal network resources, bypass firewall rules, and...