Cross-site Scripting (XSS)

Overview org.craftercms:crafter-engine is a Crafter Content Delivery Engine. Affected versions of this package are vulnerable to Cross-site Scripting XSS via API endpoints that reflect some input parameter and do produce XML responses. An attacker can inject malicious scripts by sending crafted...

CVE-2021-23263 Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/, /templates/ and some of the files in /.git/ non-binary...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15682 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...