craftcms
- Total products in the ecosystem
- 8
- Total vulnerabilities (90 days)
- 64
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, craftcms recorded 64 security vulnerabilities in the last 90 days across 3 products, including 48 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, cms had the most security vulnerabilities in the craftcms ecosystem, with 62 vulnerabilities—approximately 96.88% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2025-68454Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTICVE-2025-68437Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload MutationCVE-2025-68436Craft CMS vulnerable to potential information disclosure via unchecked asset relocationCVE-2025-57811Craft Potential Remote Code Execution via Twig SSTICVE-2025-54417Craft contains a theoretical bypass for CVE-2025-23209| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2025-68454Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI | Exploitation statusNot exploited | FixNo |
| Affected productcms |
| Published01/05/2026 |
| SeverityMedium |
CVE-2025-68437Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation | Exploitation statusActively exploited | FixNo | Affected productcms | Published01/05/2026 | SeverityMedium |
|---|
CVE-2025-68436Craft CMS vulnerable to potential information disclosure via unchecked asset relocation | Exploitation statusNot exploited | FixNo | Affected productcms | Published01/05/2026 | SeverityMedium |
|---|
CVE-2025-57811Craft Potential Remote Code Execution via Twig SSTI | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/25/2025 | SeverityMedium |
|---|
CVE-2025-54417Craft contains a theoretical bypass for CVE-2025-23209 | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/09/2025 | SeverityMedium |
|---|
CVE-2025-46731Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI | Exploitation statusActively exploited | FixNo | Affected productcms | Published05/05/2025 | SeverityHigh |
|---|
CVE-2025-32432Craft CMS Allows Remote Code Execution | Exploitation statusKEV | FixYes | Affected productcms | Published04/25/2025 | SeverityCritical |
|---|
CVE-2025-23209Potential RCE with a compromised security key in craft/cms | Exploitation statusKEV | FixYes | Affected productcms | Published01/18/2025 | SeverityHigh |
|---|
CVE-2024-56145RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms | Exploitation statusKEV | FixNo | Affected productcms | Published12/18/2024 | SeverityCritical |
|---|
CVE-2024-52293Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI | Exploitation statusActively exploited | FixYes | Affected productcms | Published11/13/2024 | SeverityHigh |
|---|
CVE-2024-52292Craft Allows Attackers to Read Arbitrary System Files | Exploitation statusActively exploited | FixYes | Affected productcms | Published11/13/2024 | SeverityHigh |
|---|
CVE-2024-52291Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution | Exploitation statusActively exploited | FixYes | Affected productcms | Published11/13/2024 | SeverityHigh |
|---|
CVE-2024-45406Craft CMS stored XSS in breadcrumb list and title fields | Exploitation statusActively exploited | FixNo | Affected productcms | Published09/09/2024 | SeverityMedium |
|---|
CVE-2024-41800Craft CMS Allows TOTP Token To Stay Valid After Use | Exploitation statusActively exploited | FixYes | Affected productcms | Published07/25/2024 | SeverityMedium |
|---|
CVE-2024-21622Craft CMS Privilege Escalation | Exploitation statusNot exploited | FixYes | Affected productcms | Published01/03/2024 | SeverityMedium |
|---|
CVE-2023-41892Craft CMS Remote Code Execution vulnerability | Exploitation statusNot confirmed | FixYes | Affected productcms | Published09/13/2023 | SeverityCritical |
|---|
CVE-2023-40035Craft CMS vulnerable to Remote Code Execution via validatePath bypass | Exploitation statusActively exploited | FixYes | Affected productcms | Published08/23/2023 | SeverityHigh |
|---|
CVE-2023-33195Craft CMS XSS in RSS widget feed | Exploitation statusNot exploited | FixYes | Affected productcms | Published05/27/2023 | SeverityMedium |
|---|
CVE-2023-33197Craft CMS stored XSS in indexedVolumes | Exploitation statusActively exploited | FixYes | Affected productcms | Published05/26/2023 | SeverityMedium |
|---|
CVE-2023-33196Craft CMS stored XSS in review volume | Exploitation statusActively exploited | FixYes | Affected productcms | Published05/26/2023 | SeverityMedium |
|---|
CVE-2023-33194CraftCMS stored XSS in Quick Post widget error message | Exploitation statusActively exploited | FixYes | Affected productcms | Published05/26/2023 | SeverityLow |
|---|
CVE-2023-32679Remote Code Execution via unrestricted file extension in Craft CMS | Exploitation statusActively exploited | FixNo | Affected productcms | Published05/19/2023 | SeverityHigh |
|---|
CVE-2023-31144Craft CMS vulnerable to cross site scripting in RSS feed widget | Exploitation statusNot exploited | FixYes | Affected productcms | Published05/09/2023 | SeverityMedium |
|---|
CVE-2023-23927Craft CMS stored cross-site scripting vulnerability | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/03/2023 | SeverityMedium |
|---|
174 Results | Page 4 of 4