Lucene search
+L

1575 matches found

Veracode
Veracode
added 2026/03/07 5:19 a.m.27 views

Server-Side Template Injection

Craft CMS is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of Twig input using the map filter in certain fields, which allows an attacker to craft malicious payloads and execute arbitrary code on the server...

8.6CVSS6.3AI score0.00529EPSS
SaveExploits0References5Affected Software1
Veracode
Veracode
added 2026/03/07 5:17 a.m.12 views

Server-Side Template Injection

craftcms/cms is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of Twig input using the map filter in certain fields, which allows an attacker with sufficient access to craft malicious payloads and execute arbitrary code on the server...

8.6CVSS6.2AI score0.00529EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
added 2026/03/07 5:13 a.m.14 views

Remote Code Execution (RCE)

Craft CMS is vulnerable to Remote Code Execution RCE. The vulnerability is due to a Server-Side Template Injection SSTI flaw in Twig template fields, which allows an authenticated administrator to write a malicious PHP file to a web-accessible directory and execute arbitrary system commands...

9.4CVSS6.1AI score0.01068EPSS
SaveExploits1References4Affected Software1
Veracode
Veracode
added 2026/03/07 5:09 a.m.10 views

Server-Side Template Injection

Craft CMS is vulnerable to Server-Side Template Injection. The vulnerability is due to unsafe exposure of the create Twig function enabling arbitrary object instantiation combined with a Symfony Process gadget chain, which allows an attacker to execute arbitrary code on the server...

7.5CVSS6.2AI score0.00556EPSS
SaveExploits1References2Affected Software1
RedhatCVE
RedhatCVE
added 2026/03/05 7:30 p.m.14 views

CVE-2026-28784

Craft is a content management system CMS. Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to...

8.6CVSS6AI score0.00529EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/03/05 7:30 p.m.13 views

CVE-2026-28783

Craft is a content management system CMS. Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either ha...

9.4CVSS6.1AI score0.00464EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/03/05 7:30 p.m.16 views

CVE-2026-28697

Craft is a content management system CMS. Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution RCE by injecting a Server-Side Template Injection SSTI payload into Twig template fields e.g., Email Templates. By calling the craft.app.fs.write...

9.4CVSS6.3AI score0.01068EPSS
SaveExploits1References1
NVD
NVD
added 2026/03/04 5:16 p.m.27 views

CVE-2026-28697

Craft is a content management system CMS. Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution RCE by injecting a Server-Side Template Injection SSTI payload into Twig template fields e.g., Email Templates. By calling the craft.app.fs.write...

9.4CVSS0.01068EPSS
SaveExploits1References4
NVD
NVD
added 2026/03/04 5:16 p.m.15 views

CVE-2026-28783

Craft is a content management system CMS. Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either ha...

9.4CVSS0.00464EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/04 5:16 p.m.16 views

CVE-2026-28784

Craft is a content management system CMS. Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to...

8.6CVSS0.00529EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/03/04 4:53 p.m.4 views

CVE-2026-28784 Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

Craft is a content management system CMS. Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to...

8.6CVSS6AI score0.00529EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/03/04 4:53 p.m.10 views

CVE-2026-28784

Craft is a content management system CMS. Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to...

8.6CVSS6AI score0.00529EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 2026/03/04 4:53 p.m.33 views

CVE-2026-28784

Craft CMS is affected by a Server-Side Template Injection (Twig map filter) vulnerability prior to versions 5.8.22 and 4.16.18. The issue arises in text fields that accept Twig input (Settings in the Craft Control Panel or via the System Messages utility), allowing an attacker with administrator ...

8.6CVSS6AI score0.00529EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/03/04 4:53 p.m.11 views

CVE-2026-28784 Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

Craft is a content management system CMS. Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to...

8.6CVSS5.9AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/03/04 4:53 p.m.38 views

CVE-2026-28784 Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

Craft is a content management system CMS. Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to...

8.6CVSS0.00529EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/03/04 4:50 p.m.11 views

CVE-2026-28783 Craft has a Twig Function Blocklist Bypass

Craft is a content management system CMS. Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either ha...

9.4CVSS6.1AI score0.00464EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/03/04 4:50 p.m.40 views

CVE-2026-28783 Craft has a Twig Function Blocklist Bypass

Craft is a content management system CMS. Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either ha...

9.4CVSS0.00464EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/03/04 4:50 p.m.4 views

CVE-2026-28783

Craft is a content management system CMS. Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either ha...

9.4CVSS6.1AI score0.00464EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2026/03/04 4:50 p.m.43 views

CVE-2026-28783

CVE-2026-28783 affects Craft CMS (Craft CMS core) where a blocklist of potentially dangerous PHP functions is bypassable via Twig non-Closure arrow functions. Affected versions are prior to 5.9.0-beta.1 and 4.17.0-beta.1. Successful exploitation requires attacker permissions (production allowAdmi...

9.4CVSS6.1AI score0.00464EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/03/04 4:50 p.m.8 views

CVE-2026-28783 Craft has a Twig Function Blocklist Bypass

Craft is a content management system CMS. Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either ha...

9.4CVSS6.1AI score
SaveExploits0References4
Rows per page
Query Builder