6 matches found
CVE-2026-28697 Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates
Craft is a content management system CMS. Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution RCE by injecting a Server-Side Template Injection SSTI payload into Twig template fields e.g., Email Templates. By calling the craft.app.fs.write...
CVE-2019-1228
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log on ...
Craft CMS Information Disclosure Vulnerability
Craft CMS is a content management system CMS for developers and content managers. A security vulnerability exists in Craft CMS versions prior to 2.6.2976, which stems from the program failing to properly restrict viewing of the contents of the craft/app/folder. An attacker could exploit this...
CVE-2017-8383
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...
PT-2017-18306
Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976 Description The issue is related to improper restriction of viewing the contents of files in the craft/app/ folder. This could potentially allow unauthorized access to sensitive information. Recommendations...
