craftcms
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 115 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from April 22, 2017 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users
Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Monitor craftcms in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.