2467 matches found
Craft CMS: Incorrect path validation could potentially lead to path traversal
The ensurePathIsContained function of the Local file system class is theoretically vulnerable to path traversal, although no exploitable scenario has been discovered. When a file is read, an Asset object uses the getFileStream method of the Volume where the asset file is stored, which in turn use...
Cross-site Scripting (XSS)
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the draftName field in the control panel rendering process. An attacker can execute arbitrary JavaScript in the session of higher-privileged users by crafting a...
Improper Authorization
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improper Authorization via the elements/save process. An attacker can change their own password without providing the current password, and, if possessing the edit users permission, can chang...
Craft CMS: Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE in a manner similar to previously disclosed vulnerabilities. The Twig sandbox in Craft CMS works by implementing Twig's SecurityPolicyInterface. The resultin...
GHSA-F5WM-88JV-G5HX Craft CMS: Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE in a manner similar to previously disclosed vulnerabilities. The Twig sandbox in Craft CMS works by implementing Twig's SecurityPolicyInterface. The resultin...
EUVD-2026-41804
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets...
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the condition.config process. An attacker can execute arbitrary operating system commands, read sensitive...
GHSA-265M-7826-WJQM Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...
CVE-2026-67299 FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...
Exploit for Code Injection in Craftcms Craft_Cms
CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit para execução...
CVE-2026-17776
Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...
Exploit for Code Injection in Craftcms Craft_Cms
CVE-2025-32432 Craft CMS PoC Single-target proof-of-concept...
Exploit for Code Injection in Craftcms Craft_Cms
CVE-2025-32432 Craft CMS Pre-Auth RCE PoC Critical Pre-Auth...
GHSA-CVPC-HCCG-WMW4 Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited Formie access could directly access Formie settings pages and modify global plugin configuration. In affected versions, Formie...
Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited Formie access could directly access Formie settings pages and modify global plugin configuration. In affected versions, Formie...
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
The actionRenderCardPreview method in FieldsController passes the fieldLayoutConfig POST parameter directly to Fields::createLayout without calling Component::cleanseConfig. This allows Yii2 event handler injection via on eventName keys in the config array, leading to arbitrary code execution. Th...
GHSA-86VW-X4WW-X467 Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
The actionRenderCardPreview method in FieldsController passes the fieldLayoutConfig POST parameter directly to Fields::createLayout without calling Component::cleanseConfig. This allows Yii2 event handler injection via on eventName keys in the config array, leading to arbitrary code execution. Th...
SUSE CVE-2026-14097
Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...