1391 matches found
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
The Craft CMS GraphQL saveAsset mutation is vulnerable to Server-Side Request Forgery SSRF. This vulnerability arises because the file input, specifically its url parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by...
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions 5.8.21 and 4.16.17 to mitigate the issue. Resources:...
GHSA-53VF-C43H-J2X9 Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions 5.8.21 and 4.16.17 to mitigate the issue. Resources:...
PT-2026-21652
Name of the Vulnerable Software and Affected Versions Craft versions 4.5.0-RC1 through 4.16.18 Craft versions 5.0.0-RC1 through 5.8.22 Description Craft is a content management system CMS. The SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname, which only resolves IPv4...
Craft CMS 安全漏洞
Craft CMS is an open source content management system CMS from Craft CMS. A security vulnerability exists in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, which stems from a malicious add-on behavior that could lead to authenticated remote code execution...
Craft CMS 代码问题漏洞
Craft CMS is a content management system CMS open source by Craft CMS. A code issue vulnerability exists in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, which stems from insufficient validation of the url parameter in a GraphQL mutation, and could lead to a server-si...
Craft CMS 安全漏洞
Craft CMS is an open source content management system CMS from Craft CMS. A security vulnerability exists in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, which originates from a database backup operation that can be triggered by an unauthenticated user, which could resul...
CVE-2025-68437
creationtimestamp| type| source ---|---|--- 2026-01-03 22:19:31+00:00| published-proof-of-concept| https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc...
📄 Craft CMS 5.0 Twig Template Injection Scanner
This is a mass scanning script for the Craft CMS version 5.0 Twig template injection vulnerability. ============================================================================================================================================= | Title : Craft CMS 5.0 Twig Template Injection – Mass...
📄 Craft CMS 5.0 Logic Flaw
A flaw in the Craft CMS image transform endpoint allows an unauthenticated attacker to trigger backend processing without prior authentication. While the original Metasploit module targeted remote code execution, this proof of concept does not execute code, does not write files, and does not inje...
EUVD-2021-1499
Malware in sbrugna...
EUVD-2019-18925
Malware in sbrugna...
EUVD-2021-2209
Malware in sbrugna...
EUVD-2021-1437
Malware in sbrugna...
EUVD-2022-2766
Malicious code in bioql PyPI...
EUVD-2022-2439
Malicious code in bioql PyPI...
EUVD-2023-1496
Malicious code in bioql PyPI...
EUVD-2022-2658
Malicious code in bioql PyPI...