PT-2025-17927

Name of the Vulnerable Software and Affected Versions Craft CMS versions 3.0.0-RC1 through 3.9.14 Craft CMS versions 4.0.0-RC1 through 4.14.14 Craft CMS versions 5.0.0-RC1 through 5.6.16 Description Craft CMS contains a critical issue related to improper code generation management, allowing...

VulnCheck KEV: CVE-2025-32432

Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code...

Ethercreative Logs 3.0.3 - Path Traversal

Exploit Title: Ethercreative Logs 3.0.3 - Path Traversal Date: 2022.01.26 Exploit Author: Steffen Rogge, SC Vendor Homepage: https://github.com/ethercreative/logs Software Link: https://plugins.craftcms.com/logs Version: =3.0.4 impact: Medium found: 2021-07-06 SEC Consult Vulnerability Lab An...

CVE-2025-32427

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who hav...

CVE-2025-32427

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who hav...

CVE-2025-32426

CVE-2025-32426 affects the Formie Craft CMS form plugin. The issue is an HTML injection (XSS) vulnerability in the HTML content of email notification previews, exploitable only if an attacker can modify the form’s email notification settings. The root cause is insufficient sanitization in the ema...

CVE-2025-32426 Formie has a XSS vulnerability for email notification content for preview

Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means a delivered email. This would requir...

CVE-2025-32426 Formie has a XSS vulnerability for email notification content for preview

Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means a delivered email. This would requir...

CVE-2025-32427 Formie has a XSS vulnerability for importing forms

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who hav...

CVE-2025-32427

CVE-2025-32427 concerns the verbb/formie Craft CMS plugin. Before version 2.1.44, importing a form from JSON could leak XSS if a field label or handle contained malicious content, because the preview output was not properly escaped. The vulnerability requires intentional tampering with the JSON e...

CVE-2025-32427 Formie has a XSS vulnerability for importing forms

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who hav...

CVE-2025-32427 Formie has a XSS vulnerability for importing forms

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who hav...

Formie for Craft CMS 跨站脚本漏洞

Formie for Craft CMS is an open source form plugin for Craft CMS by Verbb. A cross-site scripting vulnerability exists in Formie for Craft CMS versions prior to 2.1.44, which stems from the possible injection of malicious code into HTML content...

Formie for Craft CMS 跨站脚本漏洞

Formie for Craft CMS is an open source form plugin for Craft CMS by Verbb. A cross-site scripting vulnerability exists in Formie for Craft CMS versions prior to 2.1.44 that stems from not properly escaping output when importing forms...

VulnCheck KEV: CVE-2024-58136

Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432...

CVE-2025-31488

Plain Craft Launcher PCL is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in the homepage, WPF will use Internet Explorer to load the specified webpage. If the user uses a malicious homepage, the attacker can use IE...

CVE-2025-31488

Plain Craft Launcher PCL is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in the homepage, WPF will use Internet Explorer to load the specified webpage. If the user uses a malicious homepage, the attacker can use IE...

CVE-2025-31488 Plain Craft Launcher's custom homepage can use Internet Explorer to load web pages with the help of controls such as WebBrowser

Plain Craft Launcher PCL is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in the homepage, WPF will use Internet Explorer to load the specified webpage. If the user uses a malicious homepage, the attacker can use IE...

CVE-2025-31488 Plain Craft Launcher's custom homepage can use Internet Explorer to load web pages with the help of controls such as WebBrowser

Plain Craft Launcher PCL is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in the homepage, WPF will use Internet Explorer to load the specified webpage. If the user uses a malicious homepage, the attacker can use IE...

CVE-2025-31488

Plain Craft Launcher (PCL) is affected. When a homepage uses WebBrowser controls in its WPF UI, the app loads the page via Internet Explorer in the background, allowing an attacker with a malicious homepage to access the target webpage without user awareness. The issue is fixed in version 2.9.3.