Craft Commerce 跨站脚本漏洞

Craft Commerce is an e-commerce platform developed under the open-source Craft CMS framework. Versions of Craft Commerce prior to 5.5.3 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper HTML escaping during the rendering of the Name field on the Commerce...

PT-2026-24403

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.17.4 Craft versions prior to 5.9.7 Description Craft CMS has a Cross-Site Request Forgery CSRF issue in the preview token endpoint. The endpoint, located at /actions/preview/create-token, accepts an attacker-supplied...

CVE-2026-29176

creationtimestamp| type| source ---|---|--- 2026-03-09 23:05:43+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-wj89-2385-gpx3...

CVE-2026-29175

creationtimestamp| type| source ---|---|--- 2026-03-09 23:05:14+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-cfpv-rmpf-f624...

CVE-2026-29173

creationtimestamp| type| source ---|---|--- 2026-03-09 22:12:43+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-mqxf-2998-c6cp...

CVE-2026-29172

creationtimestamp| type| source ---|---|--- 2026-03-09 22:11:46+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-j3x5-mghf-xvfw...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-Public - Vulnerability Proof-of-Concept Script Library...

Server-Side Template Injection

Craft CMS is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of Twig input using the map filter in certain fields, which allows an attacker to craft malicious payloads and execute arbitrary code on the server...

Missing Authorization

craftcms/cms is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks in the GraphQL @parseRefs directive, which allows an attacker to access sensitive attributes of CMS elements without proper permissions...

Server-Side Template Injection

Craft CMS is vulnerable to Server-Side Template Injection. The vulnerability is due to unsafe exposure of the create Twig function enabling arbitrary object instantiation combined with a Symfony Process gadget chain, which allows an attacker to execute arbitrary code on the server...

Missing Authorization

craftcms/cms is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks in the GraphQL @parseRefs directive, which allows an attacker to access sensitive data from CMS elements without proper permissions...

CVE-2026-28783

Craft is a content management system CMS. Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either ha...

CVE-2026-28784

Craft is a content management system CMS. Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to...

CVE-2026-28781

Craft is a content management system CMS. Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds or authorId parameter into the POST request, which the backend...

Authorization Bypass Through User-Controlled Key

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the actionSendActivationEmail function. An attacker can gain unauthorized access to user accounts or enumerate user states by submitting...

GHSA-234Q-VVW3-MRFQ Craft CMS has unauthenticated activation email trigger with potential user enumeration

The actionSendActivationEmail endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the...

CVE-2026-29069

Craft is a content management system CMS. Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pendin...

CVE-2026-28784

Craft is a content management system CMS. Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to...

CVE-2026-28782

Craft is a content management system CMS. Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission where the "Duplicate" action is...

CVE-2026-28783

Craft is a content management system CMS. Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either ha...