Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/craftcms/cms@3.2.0-alpha.6.3
Typecomposer
Namespacecraftcms
Namecms
Version3.2.0-alpha.6.3
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.17.12
Latest_non_vulnerable_version5.9.18
Affected_by_vulnerabilities
0
url VCID-3r9x-ax4j-3yha
vulnerability_id VCID-3r9x-ax4j-3yha
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Craft CMS before 3.7.29 allows XSS.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-28378
reference_id
reference_type
scores
0
value 0.00328
scoring_system epss
scoring_elements 0.56045
published_at 2026-06-04T12:55:00Z
1
value 0.00328
scoring_system epss
scoring_elements 0.561
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-28378
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18
3
reference_url https://github.com/craftcms/cms/commit/7ca2b2d2ccecfb524525afc8ceac6f6e44f84b88
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/commit/7ca2b2d2ccecfb524525afc8ceac6f6e44f84b88
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-28378
reference_id CVE-2022-28378
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-28378
5
reference_url https://github.com/advisories/GHSA-7xj5-fwqr-5378
reference_id GHSA-7xj5-fwqr-5378
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7xj5-fwqr-5378
fixed_packages
0
url pkg:composer/craftcms/cms@3.7.29
purl pkg:composer/craftcms/cms@3.7.29
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-41y2-tucq-ykaj
1
vulnerability VCID-5mnd-qvaq-k3am
2
vulnerability VCID-5pur-jy1x-gfhv
3
vulnerability VCID-6hcd-ayyh-3fdb
4
vulnerability VCID-8pjj-w8h7-p7ga
5
vulnerability VCID-aajd-9qsf-37cr
6
vulnerability VCID-c2nk-y4rx-1qf4
7
vulnerability VCID-chep-xthg-zuee
8
vulnerability VCID-cwm6-qf1f-2keb
9
vulnerability VCID-dz26-b2ts-puep
10
vulnerability VCID-ec34-nvn3-qbcb
11
vulnerability VCID-eecq-8t4y-kka3
12
vulnerability VCID-fpea-e48p-kfbn
13
vulnerability VCID-hkp9-3hzv-quhk
14
vulnerability VCID-hm7h-7cu3-8be1
15
vulnerability VCID-jhen-vhqx-n7dr
16
vulnerability VCID-jxet-d8ux-mkge
17
vulnerability VCID-qcwp-su57-9fa1
18
vulnerability VCID-qq68-3j4y-47am
19
vulnerability VCID-rb7c-3nkc-gkeg
20
vulnerability VCID-s5v6-e631-17f5
21
vulnerability VCID-vbz3-3rqd-3fh6
22
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.29
aliases CVE-2022-28378, GHSA-7xj5-fwqr-5378
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3r9x-ax4j-3yha
1
url VCID-41y2-tucq-ykaj
vulnerability_id VCID-41y2-tucq-ykaj
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-23927
reference_id
reference_type
scores
0
value 0.02749
scoring_system epss
scoring_elements 0.8627
published_at 2026-06-04T12:55:00Z
1
value 0.02749
scoring_system epss
scoring_elements 0.86292
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-23927
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:30:35Z/
url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03
3
reference_url https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:30:35Z/
url https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-23927
reference_id CVE-2023-23927
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-23927
5
reference_url https://github.com/advisories/GHSA-qcrj-6ffc-v7hq
reference_id GHSA-qcrj-6ffc-v7hq
reference_type
scores
url https://github.com/advisories/GHSA-qcrj-6ffc-v7hq
6
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq
reference_id GHSA-qcrj-6ffc-v7hq
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:30:35Z/
url https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq
fixed_packages
0
url pkg:composer/craftcms/cms@3.7.64
purl pkg:composer/craftcms/cms@3.7.64
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-41y2-tucq-ykaj
1
vulnerability VCID-5mnd-qvaq-k3am
2
vulnerability VCID-5pur-jy1x-gfhv
3
vulnerability VCID-6hcd-ayyh-3fdb
4
vulnerability VCID-aajd-9qsf-37cr
5
vulnerability VCID-c2nk-y4rx-1qf4
6
vulnerability VCID-chep-xthg-zuee
7
vulnerability VCID-dz26-b2ts-puep
8
vulnerability VCID-ec34-nvn3-qbcb
9
vulnerability VCID-fpea-e48p-kfbn
10
vulnerability VCID-hkp9-3hzv-quhk
11
vulnerability VCID-hm7h-7cu3-8be1
12
vulnerability VCID-jhen-vhqx-n7dr
13
vulnerability VCID-jxet-d8ux-mkge
14
vulnerability VCID-qcwp-su57-9fa1
15
vulnerability VCID-qq68-3j4y-47am
16
vulnerability VCID-rb7c-3nkc-gkeg
17
vulnerability VCID-s5v6-e631-17f5
18
vulnerability VCID-vbz3-3rqd-3fh6
19
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.64
1
url pkg:composer/craftcms/cms@4.3.7
purl pkg:composer/craftcms/cms@4.3.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-2vn9-2cs3-vbg3
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5cxe-tjpb-3qan
6
vulnerability VCID-5mnd-qvaq-k3am
7
vulnerability VCID-5pur-jy1x-gfhv
8
vulnerability VCID-6hcd-ayyh-3fdb
9
vulnerability VCID-71sv-62m4-z3er
10
vulnerability VCID-7y4f-ef7t-47eb
11
vulnerability VCID-83rt-3tyj-qbgx
12
vulnerability VCID-8u2j-17a4-q7eh
13
vulnerability VCID-9ca4-tbhq-27ad
14
vulnerability VCID-9enr-b6zd-mbh8
15
vulnerability VCID-aajd-9qsf-37cr
16
vulnerability VCID-akrv-yqnf-1kg8
17
vulnerability VCID-azr5-12f8-hfbm
18
vulnerability VCID-c2nk-y4rx-1qf4
19
vulnerability VCID-chep-xthg-zuee
20
vulnerability VCID-cys8-jnmu-77ec
21
vulnerability VCID-dz26-b2ts-puep
22
vulnerability VCID-e94m-mj1k-8kbr
23
vulnerability VCID-eaxm-rjr7-xudb
24
vulnerability VCID-ec34-nvn3-qbcb
25
vulnerability VCID-efwv-r3nc-73h9
26
vulnerability VCID-f7gc-cgka-tycr
27
vulnerability VCID-fpea-e48p-kfbn
28
vulnerability VCID-fpke-p7sz-nfc9
29
vulnerability VCID-gzry-xtu5-ukhu
30
vulnerability VCID-h6t5-pdp5-8qhe
31
vulnerability VCID-hkp9-3hzv-quhk
32
vulnerability VCID-hm7h-7cu3-8be1
33
vulnerability VCID-hyct-5gap-7kdu
34
vulnerability VCID-jeyh-3jxd-z3g6
35
vulnerability VCID-jhen-vhqx-n7dr
36
vulnerability VCID-jsfs-azcs-mfcm
37
vulnerability VCID-jxet-d8ux-mkge
38
vulnerability VCID-jxz8-g6fq-dubw
39
vulnerability VCID-kbrc-85av-nfcn
40
vulnerability VCID-m5rf-usae-yfb7
41
vulnerability VCID-nmzu-mefv-tqeh
42
vulnerability VCID-ppet-ruae-1kav
43
vulnerability VCID-qcwp-su57-9fa1
44
vulnerability VCID-qq68-3j4y-47am
45
vulnerability VCID-qwmy-d2e8-5khw
46
vulnerability VCID-qywv-vf4r-8bh9
47
vulnerability VCID-r5hp-5nju-9ubz
48
vulnerability VCID-rb7c-3nkc-gkeg
49
vulnerability VCID-rvrz-498f-2uet
50
vulnerability VCID-rzq4-h1ms-nqef
51
vulnerability VCID-sa99-8awj-eycd
52
vulnerability VCID-twuy-wzb7-k7g3
53
vulnerability VCID-tzjk-x116-ayge
54
vulnerability VCID-vasz-rnn1-67ev
55
vulnerability VCID-w9yn-1573-hyau
56
vulnerability VCID-wcx6-wed9-gub2
57
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.3.7
aliases CVE-2023-23927, GHSA-qcrj-6ffc-v7hq
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-41y2-tucq-ykaj
2
url VCID-5mnd-qvaq-k3am
vulnerability_id VCID-5mnd-qvaq-k3am
summary 
Unauthenticated Craft CMS users can trigger a database backup
Unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure.Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.Resources:

https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-68456
reference_id
reference_type
scores
0
value 0.00214
scoring_system epss
scoring_elements 0.4399
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-68456
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
reference_id
reference_type
scores
0
value 7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
1
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-06T14:26:08Z/
url https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
3
reference_url https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39
reference_id
reference_type
scores
0
value 7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
1
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-06T14:26:08Z/
url https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-68456
reference_id CVE-2025-68456
reference_type
scores
0
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-68456
5
reference_url https://github.com/advisories/GHSA-v64r-7wg9-23pr
reference_id GHSA-v64r-7wg9-23pr
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-v64r-7wg9-23pr
6
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr
reference_id GHSA-v64r-7wg9-23pr
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
1
value 7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
2
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
3
value HIGH
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-06T14:26:08Z/
url https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr
fixed_packages
0
url pkg:composer/craftcms/cms@4.16.17
purl pkg:composer/craftcms/cms@4.16.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-39ct-cg7w-kyb6
1
vulnerability VCID-41uv-1axm-fugb
2
vulnerability VCID-4wkr-jx1w-77hn
3
vulnerability VCID-5q5g-jrxm-eyhe
4
vulnerability VCID-83rt-3tyj-qbgx
5
vulnerability VCID-8u2j-17a4-q7eh
6
vulnerability VCID-9ca4-tbhq-27ad
7
vulnerability VCID-9enr-b6zd-mbh8
8
vulnerability VCID-a3b5-pwyh-yugv
9
vulnerability VCID-akrv-yqnf-1kg8
10
vulnerability VCID-azr5-12f8-hfbm
11
vulnerability VCID-cys8-jnmu-77ec
12
vulnerability VCID-e94m-mj1k-8kbr
13
vulnerability VCID-eaxm-rjr7-xudb
14
vulnerability VCID-efwv-r3nc-73h9
15
vulnerability VCID-fpea-e48p-kfbn
16
vulnerability VCID-fpke-p7sz-nfc9
17
vulnerability VCID-gzry-xtu5-ukhu
18
vulnerability VCID-hkp9-3hzv-quhk
19
vulnerability VCID-hyct-5gap-7kdu
20
vulnerability VCID-jeyh-3jxd-z3g6
21
vulnerability VCID-jxz8-g6fq-dubw
22
vulnerability VCID-kbrc-85av-nfcn
23
vulnerability VCID-m5rf-usae-yfb7
24
vulnerability VCID-nmzu-mefv-tqeh
25
vulnerability VCID-p3n8-1sht-bfbt
26
vulnerability VCID-ppet-ruae-1kav
27
vulnerability VCID-qwmy-d2e8-5khw
28
vulnerability VCID-qywv-vf4r-8bh9
29
vulnerability VCID-rzq4-h1ms-nqef
30
vulnerability VCID-sa99-8awj-eycd
31
vulnerability VCID-twuy-wzb7-k7g3
32
vulnerability VCID-tzjk-x116-ayge
33
vulnerability VCID-vasz-rnn1-67ev
34
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.16.17
1
url pkg:composer/craftcms/cms@5.8.21
purl pkg:composer/craftcms/cms@5.8.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-39ct-cg7w-kyb6
1
vulnerability VCID-41uv-1axm-fugb
2
vulnerability VCID-4wkr-jx1w-77hn
3
vulnerability VCID-5q5g-jrxm-eyhe
4
vulnerability VCID-5tzm-738x-xka9
5
vulnerability VCID-83rt-3tyj-qbgx
6
vulnerability VCID-8u2j-17a4-q7eh
7
vulnerability VCID-9ca4-tbhq-27ad
8
vulnerability VCID-9enr-b6zd-mbh8
9
vulnerability VCID-a3b5-pwyh-yugv
10
vulnerability VCID-a8p2-5cmc-n7g2
11
vulnerability VCID-akrv-yqnf-1kg8
12
vulnerability VCID-asek-4gme-gug8
13
vulnerability VCID-azr5-12f8-hfbm
14
vulnerability VCID-bqep-3c6u-mqhu
15
vulnerability VCID-cys8-jnmu-77ec
16
vulnerability VCID-e94m-mj1k-8kbr
17
vulnerability VCID-eaxm-rjr7-xudb
18
vulnerability VCID-efwv-r3nc-73h9
19
vulnerability VCID-esma-wxje-eqh3
20
vulnerability VCID-fpea-e48p-kfbn
21
vulnerability VCID-fpke-p7sz-nfc9
22
vulnerability VCID-gzry-xtu5-ukhu
23
vulnerability VCID-hkp9-3hzv-quhk
24
vulnerability VCID-hyct-5gap-7kdu
25
vulnerability VCID-jeyh-3jxd-z3g6
26
vulnerability VCID-jnrx-e9b5-wqew
27
vulnerability VCID-jxz8-g6fq-dubw
28
vulnerability VCID-kbrc-85av-nfcn
29
vulnerability VCID-m5rf-usae-yfb7
30
vulnerability VCID-nmzu-mefv-tqeh
31
vulnerability VCID-p3n8-1sht-bfbt
32
vulnerability VCID-pgm4-svq8-tfc5
33
vulnerability VCID-ppet-ruae-1kav
34
vulnerability VCID-qwmy-d2e8-5khw
35
vulnerability VCID-qywv-vf4r-8bh9
36
vulnerability VCID-rzq4-h1ms-nqef
37
vulnerability VCID-sa99-8awj-eycd
38
vulnerability VCID-twuy-wzb7-k7g3
39
vulnerability VCID-tzjk-x116-ayge
40
vulnerability VCID-vasz-rnn1-67ev
41
vulnerability VCID-vvhc-rnpr-ubey
42
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.8.21
aliases CVE-2025-68456, GHSA-v64r-7wg9-23pr
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5mnd-qvaq-k3am
3
url VCID-5pur-jy1x-gfhv
vulnerability_id VCID-5pur-jy1x-gfhv
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-33197
reference_id
reference_type
scores
0
value 0.00848
scoring_system epss
scoring_elements 0.75246
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-33197
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:32:08Z/
url https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766
3
reference_url https://github.com/craftcms/cms/releases/tag/4.4.6
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:32:08Z/
url https://github.com/craftcms/cms/releases/tag/4.4.6
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-33197
reference_id CVE-2023-33197
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-33197
5
reference_url https://github.com/advisories/GHSA-6qjx-787v-6pxr
reference_id GHSA-6qjx-787v-6pxr
reference_type
scores
url https://github.com/advisories/GHSA-6qjx-787v-6pxr
6
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr
reference_id GHSA-6qjx-787v-6pxr
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:32:08Z/
url https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr
fixed_packages
0
url pkg:composer/craftcms/cms@4.4.6
purl pkg:composer/craftcms/cms@4.4.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-2vn9-2cs3-vbg3
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5cxe-tjpb-3qan
6
vulnerability VCID-5mnd-qvaq-k3am
7
vulnerability VCID-71sv-62m4-z3er
8
vulnerability VCID-7y4f-ef7t-47eb
9
vulnerability VCID-83rt-3tyj-qbgx
10
vulnerability VCID-8u2j-17a4-q7eh
11
vulnerability VCID-9ca4-tbhq-27ad
12
vulnerability VCID-9enr-b6zd-mbh8
13
vulnerability VCID-aajd-9qsf-37cr
14
vulnerability VCID-akrv-yqnf-1kg8
15
vulnerability VCID-azr5-12f8-hfbm
16
vulnerability VCID-c2nk-y4rx-1qf4
17
vulnerability VCID-chep-xthg-zuee
18
vulnerability VCID-cys8-jnmu-77ec
19
vulnerability VCID-dz26-b2ts-puep
20
vulnerability VCID-e94m-mj1k-8kbr
21
vulnerability VCID-eaxm-rjr7-xudb
22
vulnerability VCID-ec34-nvn3-qbcb
23
vulnerability VCID-efwv-r3nc-73h9
24
vulnerability VCID-f7gc-cgka-tycr
25
vulnerability VCID-fpea-e48p-kfbn
26
vulnerability VCID-fpke-p7sz-nfc9
27
vulnerability VCID-gzry-xtu5-ukhu
28
vulnerability VCID-h6t5-pdp5-8qhe
29
vulnerability VCID-hkp9-3hzv-quhk
30
vulnerability VCID-hyct-5gap-7kdu
31
vulnerability VCID-jeyh-3jxd-z3g6
32
vulnerability VCID-jhen-vhqx-n7dr
33
vulnerability VCID-jsfs-azcs-mfcm
34
vulnerability VCID-jxet-d8ux-mkge
35
vulnerability VCID-jxz8-g6fq-dubw
36
vulnerability VCID-kbrc-85av-nfcn
37
vulnerability VCID-m5rf-usae-yfb7
38
vulnerability VCID-nmzu-mefv-tqeh
39
vulnerability VCID-ppet-ruae-1kav
40
vulnerability VCID-qq68-3j4y-47am
41
vulnerability VCID-qwmy-d2e8-5khw
42
vulnerability VCID-qywv-vf4r-8bh9
43
vulnerability VCID-r5hp-5nju-9ubz
44
vulnerability VCID-rb7c-3nkc-gkeg
45
vulnerability VCID-rzq4-h1ms-nqef
46
vulnerability VCID-sa99-8awj-eycd
47
vulnerability VCID-twuy-wzb7-k7g3
48
vulnerability VCID-tzjk-x116-ayge
49
vulnerability VCID-vasz-rnn1-67ev
50
vulnerability VCID-w9yn-1573-hyau
51
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.6
aliases CVE-2023-33197, GHSA-6qjx-787v-6pxr
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5pur-jy1x-gfhv
4
url VCID-6hcd-ayyh-3fdb
vulnerability_id VCID-6hcd-ayyh-3fdb
summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms/cms.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-31144
reference_id
reference_type
scores
0
value 0.00669
scoring_system epss
scoring_elements 0.7174
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-31144
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-28T16:40:35Z/
url https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442
3
reference_url https://github.com/craftcms/cms/commit/e2f7e7b7d86a0afa54ce855375d13c7760670764
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/commit/e2f7e7b7d86a0afa54ce855375d13c7760670764
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-31144
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-31144
5
reference_url https://github.com/advisories/GHSA-j4mx-98hw-6rv6
reference_id GHSA-j4mx-98hw-6rv6
reference_type
scores
url https://github.com/advisories/GHSA-j4mx-98hw-6rv6
6
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6
reference_id GHSA-j4mx-98hw-6rv6
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-28T16:40:35Z/
url https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6
fixed_packages
0
url pkg:composer/craftcms/cms@3.8.4
purl pkg:composer/craftcms/cms@3.8.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5mnd-qvaq-k3am
1
vulnerability VCID-5pur-jy1x-gfhv
2
vulnerability VCID-aajd-9qsf-37cr
3
vulnerability VCID-c2nk-y4rx-1qf4
4
vulnerability VCID-chep-xthg-zuee
5
vulnerability VCID-dz26-b2ts-puep
6
vulnerability VCID-ec34-nvn3-qbcb
7
vulnerability VCID-fpea-e48p-kfbn
8
vulnerability VCID-hkp9-3hzv-quhk
9
vulnerability VCID-hm7h-7cu3-8be1
10
vulnerability VCID-jhen-vhqx-n7dr
11
vulnerability VCID-jxet-d8ux-mkge
12
vulnerability VCID-qcwp-su57-9fa1
13
vulnerability VCID-qq68-3j4y-47am
14
vulnerability VCID-rb7c-3nkc-gkeg
15
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.8.4
1
url pkg:composer/craftcms/cms@4.4.4
purl pkg:composer/craftcms/cms@4.4.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-2vn9-2cs3-vbg3
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5cxe-tjpb-3qan
6
vulnerability VCID-5mnd-qvaq-k3am
7
vulnerability VCID-5pur-jy1x-gfhv
8
vulnerability VCID-71sv-62m4-z3er
9
vulnerability VCID-7y4f-ef7t-47eb
10
vulnerability VCID-83rt-3tyj-qbgx
11
vulnerability VCID-8u2j-17a4-q7eh
12
vulnerability VCID-9ca4-tbhq-27ad
13
vulnerability VCID-9enr-b6zd-mbh8
14
vulnerability VCID-aajd-9qsf-37cr
15
vulnerability VCID-akrv-yqnf-1kg8
16
vulnerability VCID-azr5-12f8-hfbm
17
vulnerability VCID-c2nk-y4rx-1qf4
18
vulnerability VCID-chep-xthg-zuee
19
vulnerability VCID-cys8-jnmu-77ec
20
vulnerability VCID-dz26-b2ts-puep
21
vulnerability VCID-e94m-mj1k-8kbr
22
vulnerability VCID-eaxm-rjr7-xudb
23
vulnerability VCID-ec34-nvn3-qbcb
24
vulnerability VCID-efwv-r3nc-73h9
25
vulnerability VCID-f7gc-cgka-tycr
26
vulnerability VCID-fpea-e48p-kfbn
27
vulnerability VCID-fpke-p7sz-nfc9
28
vulnerability VCID-gzry-xtu5-ukhu
29
vulnerability VCID-h6t5-pdp5-8qhe
30
vulnerability VCID-hkp9-3hzv-quhk
31
vulnerability VCID-hm7h-7cu3-8be1
32
vulnerability VCID-hyct-5gap-7kdu
33
vulnerability VCID-jeyh-3jxd-z3g6
34
vulnerability VCID-jhen-vhqx-n7dr
35
vulnerability VCID-jsfs-azcs-mfcm
36
vulnerability VCID-jxet-d8ux-mkge
37
vulnerability VCID-jxz8-g6fq-dubw
38
vulnerability VCID-kbrc-85av-nfcn
39
vulnerability VCID-m5rf-usae-yfb7
40
vulnerability VCID-nmzu-mefv-tqeh
41
vulnerability VCID-ppet-ruae-1kav
42
vulnerability VCID-qq68-3j4y-47am
43
vulnerability VCID-qwmy-d2e8-5khw
44
vulnerability VCID-qywv-vf4r-8bh9
45
vulnerability VCID-r5hp-5nju-9ubz
46
vulnerability VCID-rb7c-3nkc-gkeg
47
vulnerability VCID-rvrz-498f-2uet
48
vulnerability VCID-rzq4-h1ms-nqef
49
vulnerability VCID-sa99-8awj-eycd
50
vulnerability VCID-twuy-wzb7-k7g3
51
vulnerability VCID-tzjk-x116-ayge
52
vulnerability VCID-vasz-rnn1-67ev
53
vulnerability VCID-w9yn-1573-hyau
54
vulnerability VCID-wcx6-wed9-gub2
55
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.4
aliases CVE-2023-31144, GHSA-j4mx-98hw-6rv6
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6hcd-ayyh-3fdb
5
url VCID-8pjj-w8h7-p7ga
vulnerability_id VCID-8pjj-w8h7-p7ga
summary 
Weak Password Recovery Mechanism for Forgotten Password
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).
references
0
reference_url http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-29933
reference_id
reference_type
scores
0
value 0.02319
scoring_system epss
scoring_elements 0.85111
published_at 2026-06-05T12:55:00Z
1
value 0.02319
scoring_system epss
scoring_elements 0.85087
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-29933
2
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
3
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md
reference_id
reference_type
scores
url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md
4
reference_url https://sec-consult.com/vulnerability-lab
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://sec-consult.com/vulnerability-lab
5
reference_url https://sec-consult.com/vulnerability-lab/
reference_id
reference_type
scores
url https://sec-consult.com/vulnerability-lab/
6
reference_url https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms
7
reference_url https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms/
reference_id
reference_type
scores
url https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms/
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-29933
reference_id CVE-2022-29933
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-29933
9
reference_url https://github.com/advisories/GHSA-5cjr-78cq-3wrg
reference_id GHSA-5cjr-78cq-3wrg
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-5cjr-78cq-3wrg
fixed_packages
0
url pkg:composer/craftcms/cms@3.7.36
purl pkg:composer/craftcms/cms@3.7.36
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-41y2-tucq-ykaj
1
vulnerability VCID-5mnd-qvaq-k3am
2
vulnerability VCID-5pur-jy1x-gfhv
3
vulnerability VCID-6hcd-ayyh-3fdb
4
vulnerability VCID-8pjj-w8h7-p7ga
5
vulnerability VCID-aajd-9qsf-37cr
6
vulnerability VCID-c2nk-y4rx-1qf4
7
vulnerability VCID-chep-xthg-zuee
8
vulnerability VCID-dz26-b2ts-puep
9
vulnerability VCID-ec34-nvn3-qbcb
10
vulnerability VCID-fpea-e48p-kfbn
11
vulnerability VCID-hkp9-3hzv-quhk
12
vulnerability VCID-hm7h-7cu3-8be1
13
vulnerability VCID-jhen-vhqx-n7dr
14
vulnerability VCID-jxet-d8ux-mkge
15
vulnerability VCID-qcwp-su57-9fa1
16
vulnerability VCID-qq68-3j4y-47am
17
vulnerability VCID-rb7c-3nkc-gkeg
18
vulnerability VCID-s5v6-e631-17f5
19
vulnerability VCID-vbz3-3rqd-3fh6
20
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.36
1
url pkg:composer/craftcms/cms@3.7.37
purl pkg:composer/craftcms/cms@3.7.37
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-41y2-tucq-ykaj
1
vulnerability VCID-5mnd-qvaq-k3am
2
vulnerability VCID-5pur-jy1x-gfhv
3
vulnerability VCID-6hcd-ayyh-3fdb
4
vulnerability VCID-aajd-9qsf-37cr
5
vulnerability VCID-c2nk-y4rx-1qf4
6
vulnerability VCID-chep-xthg-zuee
7
vulnerability VCID-dz26-b2ts-puep
8
vulnerability VCID-ec34-nvn3-qbcb
9
vulnerability VCID-fpea-e48p-kfbn
10
vulnerability VCID-hkp9-3hzv-quhk
11
vulnerability VCID-hm7h-7cu3-8be1
12
vulnerability VCID-jhen-vhqx-n7dr
13
vulnerability VCID-jxet-d8ux-mkge
14
vulnerability VCID-qcwp-su57-9fa1
15
vulnerability VCID-qq68-3j4y-47am
16
vulnerability VCID-rb7c-3nkc-gkeg
17
vulnerability VCID-s5v6-e631-17f5
18
vulnerability VCID-vbz3-3rqd-3fh6
19
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.37
aliases CVE-2022-29933, GHSA-5cjr-78cq-3wrg
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8pjj-w8h7-p7ga
6
url VCID-aajd-9qsf-37cr
vulnerability_id VCID-aajd-9qsf-37cr
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Craft CMS through 4.4.9 is vulnerable to HTML Injection.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-33495
reference_id
reference_type
scores
0
value 0.00168
scoring_system epss
scoring_elements 0.3779
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-33495
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
3
reference_url https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-09T21:12:01Z/
url https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-33495
reference_id CVE-2023-33495
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-33495
5
reference_url https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
reference_id html-injection-in-craft-cms-application-e2b28f746212
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-09T21:12:01Z/
url https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
fixed_packages
0
url pkg:composer/craftcms/cms@4.4.10
purl pkg:composer/craftcms/cms@4.4.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-41uv-1axm-fugb
3
vulnerability VCID-4wkr-jx1w-77hn
4
vulnerability VCID-5cxe-tjpb-3qan
5
vulnerability VCID-5mnd-qvaq-k3am
6
vulnerability VCID-71sv-62m4-z3er
7
vulnerability VCID-7y4f-ef7t-47eb
8
vulnerability VCID-83rt-3tyj-qbgx
9
vulnerability VCID-8u2j-17a4-q7eh
10
vulnerability VCID-9ca4-tbhq-27ad
11
vulnerability VCID-9enr-b6zd-mbh8
12
vulnerability VCID-akrv-yqnf-1kg8
13
vulnerability VCID-azr5-12f8-hfbm
14
vulnerability VCID-c2nk-y4rx-1qf4
15
vulnerability VCID-chep-xthg-zuee
16
vulnerability VCID-cys8-jnmu-77ec
17
vulnerability VCID-dz26-b2ts-puep
18
vulnerability VCID-e94m-mj1k-8kbr
19
vulnerability VCID-eaxm-rjr7-xudb
20
vulnerability VCID-ec34-nvn3-qbcb
21
vulnerability VCID-efwv-r3nc-73h9
22
vulnerability VCID-f7gc-cgka-tycr
23
vulnerability VCID-fpea-e48p-kfbn
24
vulnerability VCID-fpke-p7sz-nfc9
25
vulnerability VCID-gzry-xtu5-ukhu
26
vulnerability VCID-h6t5-pdp5-8qhe
27
vulnerability VCID-hkp9-3hzv-quhk
28
vulnerability VCID-hyct-5gap-7kdu
29
vulnerability VCID-jeyh-3jxd-z3g6
30
vulnerability VCID-jhen-vhqx-n7dr
31
vulnerability VCID-jsfs-azcs-mfcm
32
vulnerability VCID-jxet-d8ux-mkge
33
vulnerability VCID-jxz8-g6fq-dubw
34
vulnerability VCID-kbrc-85av-nfcn
35
vulnerability VCID-m5rf-usae-yfb7
36
vulnerability VCID-nmzu-mefv-tqeh
37
vulnerability VCID-ppet-ruae-1kav
38
vulnerability VCID-qq68-3j4y-47am
39
vulnerability VCID-qwmy-d2e8-5khw
40
vulnerability VCID-qywv-vf4r-8bh9
41
vulnerability VCID-r5hp-5nju-9ubz
42
vulnerability VCID-rb7c-3nkc-gkeg
43
vulnerability VCID-rzq4-h1ms-nqef
44
vulnerability VCID-sa99-8awj-eycd
45
vulnerability VCID-twuy-wzb7-k7g3
46
vulnerability VCID-tzjk-x116-ayge
47
vulnerability VCID-vasz-rnn1-67ev
48
vulnerability VCID-w9yn-1573-hyau
49
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.10
aliases CVE-2023-33495, GHSA-m3v5-gjj9-rg24
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-aajd-9qsf-37cr
7
url VCID-adak-sn51-23gd
vulnerability_id VCID-adak-sn51-23gd
summary 
Craft CMS XSS Vulnerability
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-17496
reference_id
reference_type
scores
0
value 0.00328
scoring_system epss
scoring_elements 0.56045
published_at 2026-06-04T12:55:00Z
1
value 0.00328
scoring_system epss
scoring_elements 0.561
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-17496
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09
3
reference_url https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-17496
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-17496
5
reference_url https://github.com/advisories/GHSA-f3xr-q258-h7m9
reference_id GHSA-f3xr-q258-h7m9
reference_type
scores
url https://github.com/advisories/GHSA-f3xr-q258-h7m9
fixed_packages
0
url pkg:composer/craftcms/cms@3.3.8
purl pkg:composer/craftcms/cms@3.3.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3r9x-ax4j-3yha
1
vulnerability VCID-41y2-tucq-ykaj
2
vulnerability VCID-5mnd-qvaq-k3am
3
vulnerability VCID-5pur-jy1x-gfhv
4
vulnerability VCID-6hcd-ayyh-3fdb
5
vulnerability VCID-8pjj-w8h7-p7ga
6
vulnerability VCID-aajd-9qsf-37cr
7
vulnerability VCID-c2nk-y4rx-1qf4
8
vulnerability VCID-cwm6-qf1f-2keb
9
vulnerability VCID-dz26-b2ts-puep
10
vulnerability VCID-ec34-nvn3-qbcb
11
vulnerability VCID-eecq-8t4y-kka3
12
vulnerability VCID-hm7h-7cu3-8be1
13
vulnerability VCID-jhen-vhqx-n7dr
14
vulnerability VCID-jxet-d8ux-mkge
15
vulnerability VCID-n1z8-7a8m-rfcc
16
vulnerability VCID-nz6e-26rc-f3fa
17
vulnerability VCID-qcwp-su57-9fa1
18
vulnerability VCID-qq68-3j4y-47am
19
vulnerability VCID-s5v6-e631-17f5
20
vulnerability VCID-u4t8-gkkb-73bv
21
vulnerability VCID-vbz3-3rqd-3fh6
22
vulnerability VCID-xc5n-1vqa-tqaz
23
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.3.8
aliases CVE-2019-17496, GHSA-f3xr-q258-h7m9
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-adak-sn51-23gd
8
url VCID-c2nk-y4rx-1qf4
vulnerability_id VCID-c2nk-y4rx-1qf4
summary 
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
You are affected if your php.ini configuration has `register_argc_argv` enabled.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-56145
reference_id
reference_type
scores
0
value 0.93926
scoring_system epss
scoring_elements 0.99888
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-56145
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-06-06T03:55:30Z/
url https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3
3
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-56145
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-56145
4
reference_url https://github.com/Chocapikk/CVE-2024-56145
reference_id CVE-2024-56145
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/Chocapikk/CVE-2024-56145
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-56145
reference_id CVE-2024-56145
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-56145
6
reference_url https://github.com/advisories/GHSA-2p6p-9rc9-62j9
reference_id GHSA-2p6p-9rc9-62j9
reference_type
scores
url https://github.com/advisories/GHSA-2p6p-9rc9-62j9
7
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9
reference_id GHSA-2p6p-9rc9-62j9
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
2
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-06-06T03:55:30Z/
url https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9
fixed_packages
0
url pkg:composer/craftcms/cms@3.9.14
purl pkg:composer/craftcms/cms@3.9.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5mnd-qvaq-k3am
1
vulnerability VCID-fpea-e48p-kfbn
2
vulnerability VCID-hkp9-3hzv-quhk
3
vulnerability VCID-jxet-d8ux-mkge
4
vulnerability VCID-qq68-3j4y-47am
5
vulnerability VCID-rb7c-3nkc-gkeg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.9.14
1
url pkg:composer/craftcms/cms@4.13.2
purl pkg:composer/craftcms/cms@4.13.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-39ct-cg7w-kyb6
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5mnd-qvaq-k3am
6
vulnerability VCID-5q5g-jrxm-eyhe
7
vulnerability VCID-7y4f-ef7t-47eb
8
vulnerability VCID-83rt-3tyj-qbgx
9
vulnerability VCID-8u2j-17a4-q7eh
10
vulnerability VCID-9ca4-tbhq-27ad
11
vulnerability VCID-9enr-b6zd-mbh8
12
vulnerability VCID-a3b5-pwyh-yugv
13
vulnerability VCID-akrv-yqnf-1kg8
14
vulnerability VCID-azr5-12f8-hfbm
15
vulnerability VCID-cys8-jnmu-77ec
16
vulnerability VCID-e94m-mj1k-8kbr
17
vulnerability VCID-eaxm-rjr7-xudb
18
vulnerability VCID-efwv-r3nc-73h9
19
vulnerability VCID-fpea-e48p-kfbn
20
vulnerability VCID-fpke-p7sz-nfc9
21
vulnerability VCID-gzry-xtu5-ukhu
22
vulnerability VCID-h6t5-pdp5-8qhe
23
vulnerability VCID-hkp9-3hzv-quhk
24
vulnerability VCID-hyct-5gap-7kdu
25
vulnerability VCID-jeyh-3jxd-z3g6
26
vulnerability VCID-jsfs-azcs-mfcm
27
vulnerability VCID-jxet-d8ux-mkge
28
vulnerability VCID-jxz8-g6fq-dubw
29
vulnerability VCID-kbrc-85av-nfcn
30
vulnerability VCID-m5rf-usae-yfb7
31
vulnerability VCID-nmzu-mefv-tqeh
32
vulnerability VCID-ppet-ruae-1kav
33
vulnerability VCID-qq68-3j4y-47am
34
vulnerability VCID-qwmy-d2e8-5khw
35
vulnerability VCID-qywv-vf4r-8bh9
36
vulnerability VCID-r5hp-5nju-9ubz
37
vulnerability VCID-rb7c-3nkc-gkeg
38
vulnerability VCID-rzq4-h1ms-nqef
39
vulnerability VCID-sa99-8awj-eycd
40
vulnerability VCID-twuy-wzb7-k7g3
41
vulnerability VCID-tzjk-x116-ayge
42
vulnerability VCID-vasz-rnn1-67ev
43
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.13.2
2
url pkg:composer/craftcms/cms@5.5.2
purl pkg:composer/craftcms/cms@5.5.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-39ct-cg7w-kyb6
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5mnd-qvaq-k3am
6
vulnerability VCID-5q5g-jrxm-eyhe
7
vulnerability VCID-7y4f-ef7t-47eb
8
vulnerability VCID-83rt-3tyj-qbgx
9
vulnerability VCID-8u2j-17a4-q7eh
10
vulnerability VCID-9ca4-tbhq-27ad
11
vulnerability VCID-9enr-b6zd-mbh8
12
vulnerability VCID-a3b5-pwyh-yugv
13
vulnerability VCID-akrv-yqnf-1kg8
14
vulnerability VCID-asek-4gme-gug8
15
vulnerability VCID-azr5-12f8-hfbm
16
vulnerability VCID-cys8-jnmu-77ec
17
vulnerability VCID-e94m-mj1k-8kbr
18
vulnerability VCID-eaxm-rjr7-xudb
19
vulnerability VCID-efwv-r3nc-73h9
20
vulnerability VCID-esma-wxje-eqh3
21
vulnerability VCID-fpea-e48p-kfbn
22
vulnerability VCID-fpke-p7sz-nfc9
23
vulnerability VCID-gzry-xtu5-ukhu
24
vulnerability VCID-h6t5-pdp5-8qhe
25
vulnerability VCID-hkp9-3hzv-quhk
26
vulnerability VCID-hyct-5gap-7kdu
27
vulnerability VCID-jeyh-3jxd-z3g6
28
vulnerability VCID-jnrx-e9b5-wqew
29
vulnerability VCID-jsfs-azcs-mfcm
30
vulnerability VCID-jxet-d8ux-mkge
31
vulnerability VCID-jxz8-g6fq-dubw
32
vulnerability VCID-kbrc-85av-nfcn
33
vulnerability VCID-m5rf-usae-yfb7
34
vulnerability VCID-nmzu-mefv-tqeh
35
vulnerability VCID-pgm4-svq8-tfc5
36
vulnerability VCID-ppet-ruae-1kav
37
vulnerability VCID-qq68-3j4y-47am
38
vulnerability VCID-qywv-vf4r-8bh9
39
vulnerability VCID-r5hp-5nju-9ubz
40
vulnerability VCID-rb7c-3nkc-gkeg
41
vulnerability VCID-rzq4-h1ms-nqef
42
vulnerability VCID-sa99-8awj-eycd
43
vulnerability VCID-twuy-wzb7-k7g3
44
vulnerability VCID-tzjk-x116-ayge
45
vulnerability VCID-vasz-rnn1-67ev
46
vulnerability VCID-vvhc-rnpr-ubey
47
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.5.2
aliases CVE-2024-56145, GHSA-2p6p-9rc9-62j9
risk_score 10.0
exploitability 2.0
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-c2nk-y4rx-1qf4
9
url VCID-cwm6-qf1f-2keb
vulnerability_id VCID-cwm6-qf1f-2keb
summary 
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-37843
reference_id
reference_type
scores
0
value 0.89433
scoring_system epss
scoring_elements 0.99566
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-37843
1
reference_url https://blog.smithsecurity.biz/craft-cms-unauthenticated-sqli-via-graphql
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-12T22:53:54Z/
url https://blog.smithsecurity.biz/craft-cms-unauthenticated-sqli-via-graphql
2
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-37843
reference_id CVE-2024-37843
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-37843
4
reference_url https://github.com/advisories/GHSA-hq4f-mv3q-8wcv
reference_id GHSA-hq4f-mv3q-8wcv
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-hq4f-mv3q-8wcv
fixed_packages
0
url pkg:composer/craftcms/cms@3.7.32
purl pkg:composer/craftcms/cms@3.7.32
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-41y2-tucq-ykaj
1
vulnerability VCID-5mnd-qvaq-k3am
2
vulnerability VCID-5pur-jy1x-gfhv
3
vulnerability VCID-6hcd-ayyh-3fdb
4
vulnerability VCID-8pjj-w8h7-p7ga
5
vulnerability VCID-aajd-9qsf-37cr
6
vulnerability VCID-c2nk-y4rx-1qf4
7
vulnerability VCID-chep-xthg-zuee
8
vulnerability VCID-dz26-b2ts-puep
9
vulnerability VCID-ec34-nvn3-qbcb
10
vulnerability VCID-eecq-8t4y-kka3
11
vulnerability VCID-fpea-e48p-kfbn
12
vulnerability VCID-hkp9-3hzv-quhk
13
vulnerability VCID-hm7h-7cu3-8be1
14
vulnerability VCID-jhen-vhqx-n7dr
15
vulnerability VCID-jxet-d8ux-mkge
16
vulnerability VCID-qcwp-su57-9fa1
17
vulnerability VCID-qq68-3j4y-47am
18
vulnerability VCID-rb7c-3nkc-gkeg
19
vulnerability VCID-s5v6-e631-17f5
20
vulnerability VCID-vbz3-3rqd-3fh6
21
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.32
aliases CVE-2024-37843, GHSA-hq4f-mv3q-8wcv
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cwm6-qf1f-2keb
10
url VCID-dz26-b2ts-puep
vulnerability_id VCID-dz26-b2ts-puep
summary 
Craft CMS Feed-Me
An issue discovered in Craft CMS version 4.6.1. allows remote attackers to cause a denial of service (DoS) via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-36260
reference_id
reference_type
scores
0
value 0.00366
scoring_system epss
scoring_elements 0.58935
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-36260
1
reference_url https://github.com/craftcms/feed-me
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/feed-me
2
reference_url https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-30T16:40:39Z/
url https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28
3
reference_url https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-30T16:40:39Z/
url https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29
4
reference_url https://github.com/craftcms/feed-me/releases/tag/4.6.2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/feed-me/releases/tag/4.6.2
5
reference_url https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-30T16:40:39Z/
url https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-36260
reference_id CVE-2023-36260
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-36260
7
reference_url https://github.com/advisories/GHSA-6p78-f7h9-6838
reference_id GHSA-6p78-f7h9-6838
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6p78-f7h9-6838
fixed_packages
0
url pkg:composer/craftcms/cms@4.6.2
purl pkg:composer/craftcms/cms@4.6.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.6.2
1
url pkg:composer/craftcms/cms@4.7.0
purl pkg:composer/craftcms/cms@4.7.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-39ct-cg7w-kyb6
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5cxe-tjpb-3qan
6
vulnerability VCID-5mnd-qvaq-k3am
7
vulnerability VCID-5q5g-jrxm-eyhe
8
vulnerability VCID-71sv-62m4-z3er
9
vulnerability VCID-7y4f-ef7t-47eb
10
vulnerability VCID-83rt-3tyj-qbgx
11
vulnerability VCID-8u2j-17a4-q7eh
12
vulnerability VCID-9ca4-tbhq-27ad
13
vulnerability VCID-9enr-b6zd-mbh8
14
vulnerability VCID-a3b5-pwyh-yugv
15
vulnerability VCID-akrv-yqnf-1kg8
16
vulnerability VCID-azr5-12f8-hfbm
17
vulnerability VCID-c2nk-y4rx-1qf4
18
vulnerability VCID-chep-xthg-zuee
19
vulnerability VCID-cys8-jnmu-77ec
20
vulnerability VCID-e94m-mj1k-8kbr
21
vulnerability VCID-eaxm-rjr7-xudb
22
vulnerability VCID-efwv-r3nc-73h9
23
vulnerability VCID-fpea-e48p-kfbn
24
vulnerability VCID-fpke-p7sz-nfc9
25
vulnerability VCID-gzry-xtu5-ukhu
26
vulnerability VCID-h6t5-pdp5-8qhe
27
vulnerability VCID-hkp9-3hzv-quhk
28
vulnerability VCID-hyct-5gap-7kdu
29
vulnerability VCID-jeyh-3jxd-z3g6
30
vulnerability VCID-jsfs-azcs-mfcm
31
vulnerability VCID-jxet-d8ux-mkge
32
vulnerability VCID-jxz8-g6fq-dubw
33
vulnerability VCID-kbrc-85av-nfcn
34
vulnerability VCID-m5rf-usae-yfb7
35
vulnerability VCID-nmzu-mefv-tqeh
36
vulnerability VCID-ppet-ruae-1kav
37
vulnerability VCID-qq68-3j4y-47am
38
vulnerability VCID-qwmy-d2e8-5khw
39
vulnerability VCID-qywv-vf4r-8bh9
40
vulnerability VCID-r5hp-5nju-9ubz
41
vulnerability VCID-rb7c-3nkc-gkeg
42
vulnerability VCID-rzq4-h1ms-nqef
43
vulnerability VCID-sa99-8awj-eycd
44
vulnerability VCID-twuy-wzb7-k7g3
45
vulnerability VCID-tzjk-x116-ayge
46
vulnerability VCID-vasz-rnn1-67ev
47
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.7.0
aliases CVE-2023-36260, GHSA-6p78-f7h9-6838
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dz26-b2ts-puep
11
url VCID-ec34-nvn3-qbcb
vulnerability_id VCID-ec34-nvn3-qbcb
summary 
Craft CMS vulnerable to Remote Code Execution via validatePath bypass
Bypassing the validatePath function can lead to potential Remote Code Execution
(Post-authentication, ALLOW_ADMIN_CHANGES=true)
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-40035
reference_id
reference_type
scores
0
value 0.00308
scoring_system epss
scoring_elements 0.54323
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-40035
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/commit/0bd33861abdc60c93209cff03eeee54504d3d3b5
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-02T20:33:49Z/
url https://github.com/craftcms/cms/commit/0bd33861abdc60c93209cff03eeee54504d3d3b5
3
reference_url https://github.com/craftcms/cms/releases/tag/3.8.15
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-02T20:33:49Z/
url https://github.com/craftcms/cms/releases/tag/3.8.15
4
reference_url https://github.com/craftcms/cms/releases/tag/4.4.15
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-02T20:33:49Z/
url https://github.com/craftcms/cms/releases/tag/4.4.15
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-40035
reference_id CVE-2023-40035
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-40035
6
reference_url https://github.com/advisories/GHSA-44wr-rmwq-3phw
reference_id GHSA-44wr-rmwq-3phw
reference_type
scores
url https://github.com/advisories/GHSA-44wr-rmwq-3phw
7
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phw
reference_id GHSA-44wr-rmwq-3phw
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-02T20:33:49Z/
url https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phw
fixed_packages
0
url pkg:composer/craftcms/cms@3.8.15
purl pkg:composer/craftcms/cms@3.8.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5mnd-qvaq-k3am
1
vulnerability VCID-c2nk-y4rx-1qf4
2
vulnerability VCID-chep-xthg-zuee
3
vulnerability VCID-dz26-b2ts-puep
4
vulnerability VCID-fpea-e48p-kfbn
5
vulnerability VCID-hkp9-3hzv-quhk
6
vulnerability VCID-jhen-vhqx-n7dr
7
vulnerability VCID-jxet-d8ux-mkge
8
vulnerability VCID-qq68-3j4y-47am
9
vulnerability VCID-rb7c-3nkc-gkeg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.8.15
1
url pkg:composer/craftcms/cms@4.4.15
purl pkg:composer/craftcms/cms@4.4.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-41uv-1axm-fugb
3
vulnerability VCID-4wkr-jx1w-77hn
4
vulnerability VCID-5cxe-tjpb-3qan
5
vulnerability VCID-5mnd-qvaq-k3am
6
vulnerability VCID-71sv-62m4-z3er
7
vulnerability VCID-7y4f-ef7t-47eb
8
vulnerability VCID-83rt-3tyj-qbgx
9
vulnerability VCID-8u2j-17a4-q7eh
10
vulnerability VCID-9ca4-tbhq-27ad
11
vulnerability VCID-9enr-b6zd-mbh8
12
vulnerability VCID-akrv-yqnf-1kg8
13
vulnerability VCID-azr5-12f8-hfbm
14
vulnerability VCID-c2nk-y4rx-1qf4
15
vulnerability VCID-chep-xthg-zuee
16
vulnerability VCID-cys8-jnmu-77ec
17
vulnerability VCID-dz26-b2ts-puep
18
vulnerability VCID-e94m-mj1k-8kbr
19
vulnerability VCID-eaxm-rjr7-xudb
20
vulnerability VCID-efwv-r3nc-73h9
21
vulnerability VCID-fpea-e48p-kfbn
22
vulnerability VCID-fpke-p7sz-nfc9
23
vulnerability VCID-gzry-xtu5-ukhu
24
vulnerability VCID-h6t5-pdp5-8qhe
25
vulnerability VCID-hkp9-3hzv-quhk
26
vulnerability VCID-hyct-5gap-7kdu
27
vulnerability VCID-jeyh-3jxd-z3g6
28
vulnerability VCID-jhen-vhqx-n7dr
29
vulnerability VCID-jsfs-azcs-mfcm
30
vulnerability VCID-jxet-d8ux-mkge
31
vulnerability VCID-jxz8-g6fq-dubw
32
vulnerability VCID-kbrc-85av-nfcn
33
vulnerability VCID-m5rf-usae-yfb7
34
vulnerability VCID-nmzu-mefv-tqeh
35
vulnerability VCID-ppet-ruae-1kav
36
vulnerability VCID-qq68-3j4y-47am
37
vulnerability VCID-qwmy-d2e8-5khw
38
vulnerability VCID-qywv-vf4r-8bh9
39
vulnerability VCID-r5hp-5nju-9ubz
40
vulnerability VCID-rb7c-3nkc-gkeg
41
vulnerability VCID-rzq4-h1ms-nqef
42
vulnerability VCID-sa99-8awj-eycd
43
vulnerability VCID-twuy-wzb7-k7g3
44
vulnerability VCID-tzjk-x116-ayge
45
vulnerability VCID-vasz-rnn1-67ev
46
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.15
aliases CVE-2023-40035, GHSA-44wr-rmwq-3phw
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ec34-nvn3-qbcb
12
url VCID-eecq-8t4y-kka3
vulnerability_id VCID-eecq-8t4y-kka3
summary 
Craft CMS discloses password hashes
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-37783
reference_id
reference_type
scores
0
value 0.01471
scoring_system epss
scoring_elements 0.81292
published_at 2026-06-05T12:55:00Z
1
value 0.01471
scoring_system epss
scoring_elements 0.81264
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-37783
1
reference_url https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes
2
reference_url https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes/
reference_id
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T17:33:05Z/
url https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes/
3
reference_url https://cves.at/posts/cve-2022-37783/writeup
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://cves.at/posts/cve-2022-37783/writeup
4
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-37783
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-37783
6
reference_url http://www.openwall.com/lists/oss-security/2024/06/06/1
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T17:33:05Z/
url http://www.openwall.com/lists/oss-security/2024/06/06/1
7
reference_url https://github.com/advisories/GHSA-h972-v458-m892
reference_id GHSA-h972-v458-m892
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-h972-v458-m892
8
reference_url https://cves.at/posts/cve-2022-37783/writeup/
reference_id writeup
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T17:33:05Z/
url https://cves.at/posts/cve-2022-37783/writeup/
fixed_packages
0
url pkg:composer/craftcms/cms@3.7.33
purl pkg:composer/craftcms/cms@3.7.33
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-41y2-tucq-ykaj
1
vulnerability VCID-5mnd-qvaq-k3am
2
vulnerability VCID-5pur-jy1x-gfhv
3
vulnerability VCID-6hcd-ayyh-3fdb
4
vulnerability VCID-aajd-9qsf-37cr
5
vulnerability VCID-c2nk-y4rx-1qf4
6
vulnerability VCID-chep-xthg-zuee
7
vulnerability VCID-dz26-b2ts-puep
8
vulnerability VCID-ec34-nvn3-qbcb
9
vulnerability VCID-fpea-e48p-kfbn
10
vulnerability VCID-hkp9-3hzv-quhk
11
vulnerability VCID-hm7h-7cu3-8be1
12
vulnerability VCID-jhen-vhqx-n7dr
13
vulnerability VCID-jxet-d8ux-mkge
14
vulnerability VCID-qcwp-su57-9fa1
15
vulnerability VCID-qq68-3j4y-47am
16
vulnerability VCID-rb7c-3nkc-gkeg
17
vulnerability VCID-s5v6-e631-17f5
18
vulnerability VCID-vbz3-3rqd-3fh6
19
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.33
aliases CVE-2022-37783, GHSA-h972-v458-m892
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-eecq-8t4y-kka3
13
url VCID-hm7h-7cu3-8be1
vulnerability_id VCID-hm7h-7cu3-8be1
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Craft is a CMS for creating custom digital experiences on the web. The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-33194
reference_id
reference_type
scores
0
value 0.00062
scoring_system epss
scoring_elements 0.19596
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-33194
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:25:03Z/
url https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888
3
reference_url https://github.com/craftcms/cms/releases/tag/4.4.6
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:25:03Z/
url https://github.com/craftcms/cms/releases/tag/4.4.6
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-33194
reference_id CVE-2023-33194
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-33194
5
reference_url https://github.com/advisories/GHSA-3wxg-w96j-8hq9
reference_id GHSA-3wxg-w96j-8hq9
reference_type
scores
url https://github.com/advisories/GHSA-3wxg-w96j-8hq9
6
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9
reference_id GHSA-3wxg-w96j-8hq9
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:25:03Z/
url https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9
fixed_packages
0
url pkg:composer/craftcms/cms@3.8.6
purl pkg:composer/craftcms/cms@3.8.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5mnd-qvaq-k3am
1
vulnerability VCID-5pur-jy1x-gfhv
2
vulnerability VCID-aajd-9qsf-37cr
3
vulnerability VCID-c2nk-y4rx-1qf4
4
vulnerability VCID-chep-xthg-zuee
5
vulnerability VCID-dz26-b2ts-puep
6
vulnerability VCID-ec34-nvn3-qbcb
7
vulnerability VCID-fpea-e48p-kfbn
8
vulnerability VCID-hkp9-3hzv-quhk
9
vulnerability VCID-jhen-vhqx-n7dr
10
vulnerability VCID-jxet-d8ux-mkge
11
vulnerability VCID-qcwp-su57-9fa1
12
vulnerability VCID-qq68-3j4y-47am
13
vulnerability VCID-rb7c-3nkc-gkeg
14
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.8.6
1
url pkg:composer/craftcms/cms@4.4.6
purl pkg:composer/craftcms/cms@4.4.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-2vn9-2cs3-vbg3
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5cxe-tjpb-3qan
6
vulnerability VCID-5mnd-qvaq-k3am
7
vulnerability VCID-71sv-62m4-z3er
8
vulnerability VCID-7y4f-ef7t-47eb
9
vulnerability VCID-83rt-3tyj-qbgx
10
vulnerability VCID-8u2j-17a4-q7eh
11
vulnerability VCID-9ca4-tbhq-27ad
12
vulnerability VCID-9enr-b6zd-mbh8
13
vulnerability VCID-aajd-9qsf-37cr
14
vulnerability VCID-akrv-yqnf-1kg8
15
vulnerability VCID-azr5-12f8-hfbm
16
vulnerability VCID-c2nk-y4rx-1qf4
17
vulnerability VCID-chep-xthg-zuee
18
vulnerability VCID-cys8-jnmu-77ec
19
vulnerability VCID-dz26-b2ts-puep
20
vulnerability VCID-e94m-mj1k-8kbr
21
vulnerability VCID-eaxm-rjr7-xudb
22
vulnerability VCID-ec34-nvn3-qbcb
23
vulnerability VCID-efwv-r3nc-73h9
24
vulnerability VCID-f7gc-cgka-tycr
25
vulnerability VCID-fpea-e48p-kfbn
26
vulnerability VCID-fpke-p7sz-nfc9
27
vulnerability VCID-gzry-xtu5-ukhu
28
vulnerability VCID-h6t5-pdp5-8qhe
29
vulnerability VCID-hkp9-3hzv-quhk
30
vulnerability VCID-hyct-5gap-7kdu
31
vulnerability VCID-jeyh-3jxd-z3g6
32
vulnerability VCID-jhen-vhqx-n7dr
33
vulnerability VCID-jsfs-azcs-mfcm
34
vulnerability VCID-jxet-d8ux-mkge
35
vulnerability VCID-jxz8-g6fq-dubw
36
vulnerability VCID-kbrc-85av-nfcn
37
vulnerability VCID-m5rf-usae-yfb7
38
vulnerability VCID-nmzu-mefv-tqeh
39
vulnerability VCID-ppet-ruae-1kav
40
vulnerability VCID-qq68-3j4y-47am
41
vulnerability VCID-qwmy-d2e8-5khw
42
vulnerability VCID-qywv-vf4r-8bh9
43
vulnerability VCID-r5hp-5nju-9ubz
44
vulnerability VCID-rb7c-3nkc-gkeg
45
vulnerability VCID-rzq4-h1ms-nqef
46
vulnerability VCID-sa99-8awj-eycd
47
vulnerability VCID-twuy-wzb7-k7g3
48
vulnerability VCID-tzjk-x116-ayge
49
vulnerability VCID-vasz-rnn1-67ev
50
vulnerability VCID-w9yn-1573-hyau
51
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.6
aliases CVE-2023-33194, GHSA-3wxg-w96j-8hq9
risk_score 1.6
exploitability 0.5
weighted_severity 3.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hm7h-7cu3-8be1
14
url VCID-jhen-vhqx-n7dr
vulnerability_id VCID-jhen-vhqx-n7dr
summary 
Improper Privilege Management
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-21622
reference_id
reference_type
scores
0
value 0.00103
scoring_system epss
scoring_elements 0.27732
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-21622
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/
url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16
3
reference_url https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/
url https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16
4
reference_url https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/
url https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa
5
reference_url https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/
url https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843
6
reference_url https://github.com/craftcms/cms/pull/13931
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/
url https://github.com/craftcms/cms/pull/13931
7
reference_url https://github.com/craftcms/cms/pull/13932
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/
url https://github.com/craftcms/cms/pull/13932
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-21622
reference_id CVE-2024-21622
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-21622
9
reference_url https://github.com/advisories/GHSA-j5g9-j7r4-6qvx
reference_id GHSA-j5g9-j7r4-6qvx
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-j5g9-j7r4-6qvx
10
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx
reference_id GHSA-j5g9-j7r4-6qvx
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/
url https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx
fixed_packages
0
url pkg:composer/craftcms/cms@3.9.6
purl pkg:composer/craftcms/cms@3.9.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5mnd-qvaq-k3am
1
vulnerability VCID-c2nk-y4rx-1qf4
2
vulnerability VCID-chep-xthg-zuee
3
vulnerability VCID-dz26-b2ts-puep
4
vulnerability VCID-fpea-e48p-kfbn
5
vulnerability VCID-hkp9-3hzv-quhk
6
vulnerability VCID-jxet-d8ux-mkge
7
vulnerability VCID-qq68-3j4y-47am
8
vulnerability VCID-rb7c-3nkc-gkeg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.9.6
1
url pkg:composer/craftcms/cms@4.5.11
purl pkg:composer/craftcms/cms@4.5.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-39ct-cg7w-kyb6
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5cxe-tjpb-3qan
6
vulnerability VCID-5mnd-qvaq-k3am
7
vulnerability VCID-5q5g-jrxm-eyhe
8
vulnerability VCID-71sv-62m4-z3er
9
vulnerability VCID-7y4f-ef7t-47eb
10
vulnerability VCID-83rt-3tyj-qbgx
11
vulnerability VCID-8u2j-17a4-q7eh
12
vulnerability VCID-9ca4-tbhq-27ad
13
vulnerability VCID-9enr-b6zd-mbh8
14
vulnerability VCID-a3b5-pwyh-yugv
15
vulnerability VCID-akrv-yqnf-1kg8
16
vulnerability VCID-azr5-12f8-hfbm
17
vulnerability VCID-c2nk-y4rx-1qf4
18
vulnerability VCID-chep-xthg-zuee
19
vulnerability VCID-cys8-jnmu-77ec
20
vulnerability VCID-dz26-b2ts-puep
21
vulnerability VCID-e94m-mj1k-8kbr
22
vulnerability VCID-eaxm-rjr7-xudb
23
vulnerability VCID-efwv-r3nc-73h9
24
vulnerability VCID-fpea-e48p-kfbn
25
vulnerability VCID-fpke-p7sz-nfc9
26
vulnerability VCID-gzry-xtu5-ukhu
27
vulnerability VCID-h6t5-pdp5-8qhe
28
vulnerability VCID-hkp9-3hzv-quhk
29
vulnerability VCID-hyct-5gap-7kdu
30
vulnerability VCID-jeyh-3jxd-z3g6
31
vulnerability VCID-jsfs-azcs-mfcm
32
vulnerability VCID-jxet-d8ux-mkge
33
vulnerability VCID-jxz8-g6fq-dubw
34
vulnerability VCID-kbrc-85av-nfcn
35
vulnerability VCID-m5rf-usae-yfb7
36
vulnerability VCID-nmzu-mefv-tqeh
37
vulnerability VCID-ppet-ruae-1kav
38
vulnerability VCID-qq68-3j4y-47am
39
vulnerability VCID-qwmy-d2e8-5khw
40
vulnerability VCID-qywv-vf4r-8bh9
41
vulnerability VCID-r5hp-5nju-9ubz
42
vulnerability VCID-rb7c-3nkc-gkeg
43
vulnerability VCID-rzq4-h1ms-nqef
44
vulnerability VCID-sa99-8awj-eycd
45
vulnerability VCID-twuy-wzb7-k7g3
46
vulnerability VCID-tzjk-x116-ayge
47
vulnerability VCID-vasz-rnn1-67ev
48
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.5.11
aliases CVE-2024-21622, GHSA-j5g9-j7r4-6qvx
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jhen-vhqx-n7dr
15
url VCID-jxet-d8ux-mkge
vulnerability_id VCID-jxet-d8ux-mkge
summary Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at `/var/lib/php/sessions`. Such session files are named `sess_[session_value]`, where `[session_value]` is provided to the client in a `Set-Cookie` response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-35939
reference_id
reference_type
scores
0
value 0.33065
scoring_system epss
scoring_elements 0.96993
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-35939
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/commit/e4c7bac8f31010aee048409f9ef6f744a83146b2
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/commit/e4c7bac8f31010aee048409f9ef6f744a83146b2
3
reference_url https://github.com/craftcms/cms/pull/17220
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H
2
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
3
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A
4
value MODERATE
scoring_system generic_textual
scoring_elements
5
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/
6
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/
url https://github.com/craftcms/cms/pull/17220
4
reference_url https://github.com/craftcms/cms/releases/tag/4.15.3
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H
2
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
3
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A
4
value MODERATE
scoring_system generic_textual
scoring_elements
5
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/
6
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/
url https://github.com/craftcms/cms/releases/tag/4.15.3
5
reference_url https://github.com/craftcms/cms/releases/tag/5.7.5
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H
2
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
3
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A
4
value MODERATE
scoring_system generic_textual
scoring_elements
5
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/
6
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/
url https://github.com/craftcms/cms/releases/tag/5.7.5
6
reference_url https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H
2
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A
3
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
4
value MODERATE
scoring_system generic_textual
scoring_elements
5
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/
6
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/
url https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json
7
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939
8
reference_url https://www.cve.org/CVERecord?id=CVE-2025-35939
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H
1
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
2
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
3
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A
4
value MODERATE
scoring_system generic_textual
scoring_elements
5
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/
6
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/
url https://www.cve.org/CVERecord?id=CVE-2025-35939
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-35939
reference_id CVE-2025-35939
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-35939
10
reference_url https://github.com/advisories/GHSA-7vrx-9684-xrf2
reference_id GHSA-7vrx-9684-xrf2
reference_type
scores
url https://github.com/advisories/GHSA-7vrx-9684-xrf2
fixed_packages
0
url pkg:composer/craftcms/cms@4.15.3
purl pkg:composer/craftcms/cms@4.15.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-39ct-cg7w-kyb6
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5mnd-qvaq-k3am
6
vulnerability VCID-5q5g-jrxm-eyhe
7
vulnerability VCID-7y4f-ef7t-47eb
8
vulnerability VCID-83rt-3tyj-qbgx
9
vulnerability VCID-8u2j-17a4-q7eh
10
vulnerability VCID-9ca4-tbhq-27ad
11
vulnerability VCID-9enr-b6zd-mbh8
12
vulnerability VCID-a3b5-pwyh-yugv
13
vulnerability VCID-akrv-yqnf-1kg8
14
vulnerability VCID-azr5-12f8-hfbm
15
vulnerability VCID-cys8-jnmu-77ec
16
vulnerability VCID-dbcz-erbe-u7dt
17
vulnerability VCID-e94m-mj1k-8kbr
18
vulnerability VCID-eaxm-rjr7-xudb
19
vulnerability VCID-efwv-r3nc-73h9
20
vulnerability VCID-fpea-e48p-kfbn
21
vulnerability VCID-fpke-p7sz-nfc9
22
vulnerability VCID-gzry-xtu5-ukhu
23
vulnerability VCID-h6t5-pdp5-8qhe
24
vulnerability VCID-hkp9-3hzv-quhk
25
vulnerability VCID-hyct-5gap-7kdu
26
vulnerability VCID-jeyh-3jxd-z3g6
27
vulnerability VCID-jxz8-g6fq-dubw
28
vulnerability VCID-kbrc-85av-nfcn
29
vulnerability VCID-m5rf-usae-yfb7
30
vulnerability VCID-nmzu-mefv-tqeh
31
vulnerability VCID-p3n8-1sht-bfbt
32
vulnerability VCID-ppet-ruae-1kav
33
vulnerability VCID-qwmy-d2e8-5khw
34
vulnerability VCID-qywv-vf4r-8bh9
35
vulnerability VCID-rb7c-3nkc-gkeg
36
vulnerability VCID-rzq4-h1ms-nqef
37
vulnerability VCID-sa99-8awj-eycd
38
vulnerability VCID-twuy-wzb7-k7g3
39
vulnerability VCID-tzjk-x116-ayge
40
vulnerability VCID-vasz-rnn1-67ev
41
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.15.3
1
url pkg:composer/craftcms/cms@5.7.5
purl pkg:composer/craftcms/cms@5.7.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-39ct-cg7w-kyb6
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5mnd-qvaq-k3am
6
vulnerability VCID-5q5g-jrxm-eyhe
7
vulnerability VCID-5tzm-738x-xka9
8
vulnerability VCID-7y4f-ef7t-47eb
9
vulnerability VCID-83rt-3tyj-qbgx
10
vulnerability VCID-8u2j-17a4-q7eh
11
vulnerability VCID-9ca4-tbhq-27ad
12
vulnerability VCID-9enr-b6zd-mbh8
13
vulnerability VCID-a3b5-pwyh-yugv
14
vulnerability VCID-a8p2-5cmc-n7g2
15
vulnerability VCID-akrv-yqnf-1kg8
16
vulnerability VCID-asek-4gme-gug8
17
vulnerability VCID-azr5-12f8-hfbm
18
vulnerability VCID-bqep-3c6u-mqhu
19
vulnerability VCID-cys8-jnmu-77ec
20
vulnerability VCID-dbcz-erbe-u7dt
21
vulnerability VCID-e94m-mj1k-8kbr
22
vulnerability VCID-eaxm-rjr7-xudb
23
vulnerability VCID-efwv-r3nc-73h9
24
vulnerability VCID-esma-wxje-eqh3
25
vulnerability VCID-fpea-e48p-kfbn
26
vulnerability VCID-fpke-p7sz-nfc9
27
vulnerability VCID-gzry-xtu5-ukhu
28
vulnerability VCID-h6t5-pdp5-8qhe
29
vulnerability VCID-hkp9-3hzv-quhk
30
vulnerability VCID-hyct-5gap-7kdu
31
vulnerability VCID-jeyh-3jxd-z3g6
32
vulnerability VCID-jnrx-e9b5-wqew
33
vulnerability VCID-jxz8-g6fq-dubw
34
vulnerability VCID-kbrc-85av-nfcn
35
vulnerability VCID-m5rf-usae-yfb7
36
vulnerability VCID-nmzu-mefv-tqeh
37
vulnerability VCID-p3n8-1sht-bfbt
38
vulnerability VCID-pgm4-svq8-tfc5
39
vulnerability VCID-ppet-ruae-1kav
40
vulnerability VCID-qywv-vf4r-8bh9
41
vulnerability VCID-rb7c-3nkc-gkeg
42
vulnerability VCID-rzq4-h1ms-nqef
43
vulnerability VCID-sa99-8awj-eycd
44
vulnerability VCID-twuy-wzb7-k7g3
45
vulnerability VCID-tzjk-x116-ayge
46
vulnerability VCID-vasz-rnn1-67ev
47
vulnerability VCID-vvhc-rnpr-ubey
48
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.7.5
aliases CVE-2025-35939, GHSA-7vrx-9684-xrf2
risk_score 10.0
exploitability 2.0
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jxet-d8ux-mkge
16
url VCID-n1z8-7a8m-rfcc
vulnerability_id VCID-n1z8-7a8m-rfcc
summary 
Craft CMS Remote Code Injection
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-27903
reference_id
reference_type
scores
0
value 0.03824
scoring_system epss
scoring_elements 0.8836
published_at 2026-06-05T12:55:00Z
1
value 0.03824
scoring_system epss
scoring_elements 0.88342
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-27903
1
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23
2
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security
3
reference_url https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-27903
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-27903
fixed_packages
0
url pkg:composer/craftcms/cms@3.6.7
purl pkg:composer/craftcms/cms@3.6.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3r9x-ax4j-3yha
1
vulnerability VCID-41y2-tucq-ykaj
2
vulnerability VCID-5mnd-qvaq-k3am
3
vulnerability VCID-5pur-jy1x-gfhv
4
vulnerability VCID-6hcd-ayyh-3fdb
5
vulnerability VCID-8pjj-w8h7-p7ga
6
vulnerability VCID-aajd-9qsf-37cr
7
vulnerability VCID-c2nk-y4rx-1qf4
8
vulnerability VCID-c9mw-1at1-ebaz
9
vulnerability VCID-chep-xthg-zuee
10
vulnerability VCID-cwm6-qf1f-2keb
11
vulnerability VCID-dz26-b2ts-puep
12
vulnerability VCID-ec34-nvn3-qbcb
13
vulnerability VCID-eecq-8t4y-kka3
14
vulnerability VCID-fpea-e48p-kfbn
15
vulnerability VCID-hkp9-3hzv-quhk
16
vulnerability VCID-hm7h-7cu3-8be1
17
vulnerability VCID-jhen-vhqx-n7dr
18
vulnerability VCID-jxet-d8ux-mkge
19
vulnerability VCID-nz6e-26rc-f3fa
20
vulnerability VCID-qcwp-su57-9fa1
21
vulnerability VCID-qq68-3j4y-47am
22
vulnerability VCID-rb7c-3nkc-gkeg
23
vulnerability VCID-s5v6-e631-17f5
24
vulnerability VCID-u4t8-gkkb-73bv
25
vulnerability VCID-vbz3-3rqd-3fh6
26
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.7
aliases CVE-2021-27903, GHSA-x2j7-6hxm-87p3
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n1z8-7a8m-rfcc
17
url VCID-nz6e-26rc-f3fa
vulnerability_id VCID-nz6e-26rc-f3fa
summary 
Cross-site Scripting
Craft CMS has an XSS vulnerability.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-32470
reference_id
reference_type
scores
0
value 0.00328
scoring_system epss
scoring_elements 0.56045
published_at 2026-06-04T12:55:00Z
1
value 0.00328
scoring_system epss
scoring_elements 0.561
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-32470
1
reference_url https://github.com/craftcms/cms/blob/3.6.13/CHANGELOG.md#security
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/blob/3.6.13/CHANGELOG.md#security
2
reference_url https://github.com/craftcms/cms/commit/f9378aa154b5f9b64bed3d59cce0c4a8184bf5e6
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/commit/f9378aa154b5f9b64bed3d59cce0c4a8184bf5e6
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-32470
reference_id CVE-2021-32470
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-32470
4
reference_url https://github.com/advisories/GHSA-h2rj-8wgg-mm43
reference_id GHSA-h2rj-8wgg-mm43
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-h2rj-8wgg-mm43
fixed_packages
0
url pkg:composer/craftcms/cms@3.6.13
purl pkg:composer/craftcms/cms@3.6.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3r9x-ax4j-3yha
1
vulnerability VCID-41y2-tucq-ykaj
2
vulnerability VCID-5mnd-qvaq-k3am
3
vulnerability VCID-5pur-jy1x-gfhv
4
vulnerability VCID-6hcd-ayyh-3fdb
5
vulnerability VCID-8pjj-w8h7-p7ga
6
vulnerability VCID-aajd-9qsf-37cr
7
vulnerability VCID-c2nk-y4rx-1qf4
8
vulnerability VCID-c9mw-1at1-ebaz
9
vulnerability VCID-chep-xthg-zuee
10
vulnerability VCID-cwm6-qf1f-2keb
11
vulnerability VCID-dz26-b2ts-puep
12
vulnerability VCID-ec34-nvn3-qbcb
13
vulnerability VCID-eecq-8t4y-kka3
14
vulnerability VCID-fpea-e48p-kfbn
15
vulnerability VCID-hkp9-3hzv-quhk
16
vulnerability VCID-hm7h-7cu3-8be1
17
vulnerability VCID-jhen-vhqx-n7dr
18
vulnerability VCID-jxet-d8ux-mkge
19
vulnerability VCID-qcwp-su57-9fa1
20
vulnerability VCID-qq68-3j4y-47am
21
vulnerability VCID-rb7c-3nkc-gkeg
22
vulnerability VCID-s5v6-e631-17f5
23
vulnerability VCID-u4t8-gkkb-73bv
24
vulnerability VCID-vbz3-3rqd-3fh6
25
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.13
aliases CVE-2021-32470, GHSA-h2rj-8wgg-mm43
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nz6e-26rc-f3fa
18
url VCID-qcwp-su57-9fa1
vulnerability_id VCID-qcwp-su57-9fa1
summary 
Improper Control of Generation of Code ('Code Injection')
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-30179
reference_id
reference_type
scores
0
value 0.05499
scoring_system epss
scoring_elements 0.90401
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-30179
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/
url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
3
reference_url https://github.com/github/advisory-database/pull/2443
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/github/advisory-database/pull/2443
4
reference_url https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/
url https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
5
reference_url https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/
url https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-30179
reference_id CVE-2023-30179
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-30179
7
reference_url https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
reference_id CVE-2023-30179-SERVER-SIDE-TEMPLATE-INJECTION
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/
url https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
fixed_packages
0
url pkg:composer/craftcms/cms@4.4.2
purl pkg:composer/craftcms/cms@4.4.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-2vn9-2cs3-vbg3
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5cxe-tjpb-3qan
6
vulnerability VCID-5mnd-qvaq-k3am
7
vulnerability VCID-5pur-jy1x-gfhv
8
vulnerability VCID-6hcd-ayyh-3fdb
9
vulnerability VCID-71sv-62m4-z3er
10
vulnerability VCID-7y4f-ef7t-47eb
11
vulnerability VCID-83rt-3tyj-qbgx
12
vulnerability VCID-8u2j-17a4-q7eh
13
vulnerability VCID-9ca4-tbhq-27ad
14
vulnerability VCID-9enr-b6zd-mbh8
15
vulnerability VCID-aajd-9qsf-37cr
16
vulnerability VCID-akrv-yqnf-1kg8
17
vulnerability VCID-azr5-12f8-hfbm
18
vulnerability VCID-c2nk-y4rx-1qf4
19
vulnerability VCID-chep-xthg-zuee
20
vulnerability VCID-cys8-jnmu-77ec
21
vulnerability VCID-dz26-b2ts-puep
22
vulnerability VCID-e94m-mj1k-8kbr
23
vulnerability VCID-eaxm-rjr7-xudb
24
vulnerability VCID-ec34-nvn3-qbcb
25
vulnerability VCID-efwv-r3nc-73h9
26
vulnerability VCID-f7gc-cgka-tycr
27
vulnerability VCID-fpea-e48p-kfbn
28
vulnerability VCID-fpke-p7sz-nfc9
29
vulnerability VCID-gzry-xtu5-ukhu
30
vulnerability VCID-h6t5-pdp5-8qhe
31
vulnerability VCID-hkp9-3hzv-quhk
32
vulnerability VCID-hm7h-7cu3-8be1
33
vulnerability VCID-hyct-5gap-7kdu
34
vulnerability VCID-jeyh-3jxd-z3g6
35
vulnerability VCID-jhen-vhqx-n7dr
36
vulnerability VCID-jsfs-azcs-mfcm
37
vulnerability VCID-jxet-d8ux-mkge
38
vulnerability VCID-jxz8-g6fq-dubw
39
vulnerability VCID-kbrc-85av-nfcn
40
vulnerability VCID-m5rf-usae-yfb7
41
vulnerability VCID-nmzu-mefv-tqeh
42
vulnerability VCID-ppet-ruae-1kav
43
vulnerability VCID-qq68-3j4y-47am
44
vulnerability VCID-qwmy-d2e8-5khw
45
vulnerability VCID-qywv-vf4r-8bh9
46
vulnerability VCID-r5hp-5nju-9ubz
47
vulnerability VCID-rb7c-3nkc-gkeg
48
vulnerability VCID-rvrz-498f-2uet
49
vulnerability VCID-rzq4-h1ms-nqef
50
vulnerability VCID-sa99-8awj-eycd
51
vulnerability VCID-twuy-wzb7-k7g3
52
vulnerability VCID-tzjk-x116-ayge
53
vulnerability VCID-vasz-rnn1-67ev
54
vulnerability VCID-w9yn-1573-hyau
55
vulnerability VCID-wcx6-wed9-gub2
56
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.2
aliases CVE-2023-30179, GHSA-3x74-v64j-qc3f
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qcwp-su57-9fa1
19
url VCID-qq68-3j4y-47am
vulnerability_id VCID-qq68-3j4y-47am
summary 
Craft CMS Allows Remote Code Execution
This is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g

This is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-32432
reference_id
reference_type
scores
0
value 0.93094
scoring_system epss
scoring_elements 0.99798
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-32432
1
reference_url https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432
2
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
3
reference_url https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical
reference_id
reference_type
scores
0
value 10
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-03-20T15:24:23Z/
url https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical
4
reference_url https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical
reference_id
reference_type
scores
0
value 10
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-03-20T15:24:23Z/
url https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical
5
reference_url https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical
reference_id
reference_type
scores
0
value 10
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-03-20T15:24:23Z/
url https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical
6
reference_url https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47
reference_id
reference_type
scores
0
value 10
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-03-20T15:24:23Z/
url https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47
7
reference_url https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms
8
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432
9
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52525.py
reference_id CVE-2025-32432
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52525.py
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-32432
reference_id CVE-2025-32432
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-32432
11
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g
reference_id GHSA-4w8r-3xrw-v25g
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g
12
reference_url https://github.com/advisories/GHSA-f3gw-9ww9-jmc3
reference_id GHSA-f3gw-9ww9-jmc3
reference_type
scores
url https://github.com/advisories/GHSA-f3gw-9ww9-jmc3
13
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3
reference_id GHSA-f3gw-9ww9-jmc3
reference_type
scores
0
value 10
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
1
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-03-20T15:24:23Z/
url https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3
fixed_packages
0
url pkg:composer/craftcms/cms@3.9.15
purl pkg:composer/craftcms/cms@3.9.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5mnd-qvaq-k3am
1
vulnerability VCID-fpea-e48p-kfbn
2
vulnerability VCID-hkp9-3hzv-quhk
3
vulnerability VCID-jxet-d8ux-mkge
4
vulnerability VCID-rb7c-3nkc-gkeg
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.9.15
1
url pkg:composer/craftcms/cms@4.14.15
purl pkg:composer/craftcms/cms@4.14.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-39ct-cg7w-kyb6
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5mnd-qvaq-k3am
6
vulnerability VCID-5q5g-jrxm-eyhe
7
vulnerability VCID-7y4f-ef7t-47eb
8
vulnerability VCID-83rt-3tyj-qbgx
9
vulnerability VCID-8u2j-17a4-q7eh
10
vulnerability VCID-9ca4-tbhq-27ad
11
vulnerability VCID-9enr-b6zd-mbh8
12
vulnerability VCID-a3b5-pwyh-yugv
13
vulnerability VCID-akrv-yqnf-1kg8
14
vulnerability VCID-azr5-12f8-hfbm
15
vulnerability VCID-cys8-jnmu-77ec
16
vulnerability VCID-dbcz-erbe-u7dt
17
vulnerability VCID-e94m-mj1k-8kbr
18
vulnerability VCID-eaxm-rjr7-xudb
19
vulnerability VCID-efwv-r3nc-73h9
20
vulnerability VCID-fpea-e48p-kfbn
21
vulnerability VCID-fpke-p7sz-nfc9
22
vulnerability VCID-gzry-xtu5-ukhu
23
vulnerability VCID-h6t5-pdp5-8qhe
24
vulnerability VCID-hkp9-3hzv-quhk
25
vulnerability VCID-hyct-5gap-7kdu
26
vulnerability VCID-jeyh-3jxd-z3g6
27
vulnerability VCID-jxet-d8ux-mkge
28
vulnerability VCID-jxz8-g6fq-dubw
29
vulnerability VCID-kbrc-85av-nfcn
30
vulnerability VCID-m5rf-usae-yfb7
31
vulnerability VCID-nmzu-mefv-tqeh
32
vulnerability VCID-ppet-ruae-1kav
33
vulnerability VCID-qwmy-d2e8-5khw
34
vulnerability VCID-qywv-vf4r-8bh9
35
vulnerability VCID-rb7c-3nkc-gkeg
36
vulnerability VCID-rzq4-h1ms-nqef
37
vulnerability VCID-sa99-8awj-eycd
38
vulnerability VCID-twuy-wzb7-k7g3
39
vulnerability VCID-tzjk-x116-ayge
40
vulnerability VCID-vasz-rnn1-67ev
41
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.14.15
2
url pkg:composer/craftcms/cms@5.6.17
purl pkg:composer/craftcms/cms@5.6.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-39ct-cg7w-kyb6
3
vulnerability VCID-41uv-1axm-fugb
4
vulnerability VCID-4wkr-jx1w-77hn
5
vulnerability VCID-5mnd-qvaq-k3am
6
vulnerability VCID-5q5g-jrxm-eyhe
7
vulnerability VCID-5tzm-738x-xka9
8
vulnerability VCID-7y4f-ef7t-47eb
9
vulnerability VCID-83rt-3tyj-qbgx
10
vulnerability VCID-8u2j-17a4-q7eh
11
vulnerability VCID-9ca4-tbhq-27ad
12
vulnerability VCID-9enr-b6zd-mbh8
13
vulnerability VCID-a3b5-pwyh-yugv
14
vulnerability VCID-a8p2-5cmc-n7g2
15
vulnerability VCID-akrv-yqnf-1kg8
16
vulnerability VCID-asek-4gme-gug8
17
vulnerability VCID-azr5-12f8-hfbm
18
vulnerability VCID-bqep-3c6u-mqhu
19
vulnerability VCID-cys8-jnmu-77ec
20
vulnerability VCID-dbcz-erbe-u7dt
21
vulnerability VCID-e94m-mj1k-8kbr
22
vulnerability VCID-eaxm-rjr7-xudb
23
vulnerability VCID-efwv-r3nc-73h9
24
vulnerability VCID-esma-wxje-eqh3
25
vulnerability VCID-fpea-e48p-kfbn
26
vulnerability VCID-fpke-p7sz-nfc9
27
vulnerability VCID-gzry-xtu5-ukhu
28
vulnerability VCID-h6t5-pdp5-8qhe
29
vulnerability VCID-hkp9-3hzv-quhk
30
vulnerability VCID-hyct-5gap-7kdu
31
vulnerability VCID-jeyh-3jxd-z3g6
32
vulnerability VCID-jnrx-e9b5-wqew
33
vulnerability VCID-jxet-d8ux-mkge
34
vulnerability VCID-jxz8-g6fq-dubw
35
vulnerability VCID-kbrc-85av-nfcn
36
vulnerability VCID-m5rf-usae-yfb7
37
vulnerability VCID-nmzu-mefv-tqeh
38
vulnerability VCID-pgm4-svq8-tfc5
39
vulnerability VCID-ppet-ruae-1kav
40
vulnerability VCID-qywv-vf4r-8bh9
41
vulnerability VCID-rb7c-3nkc-gkeg
42
vulnerability VCID-rzq4-h1ms-nqef
43
vulnerability VCID-sa99-8awj-eycd
44
vulnerability VCID-twuy-wzb7-k7g3
45
vulnerability VCID-tzjk-x116-ayge
46
vulnerability VCID-vasz-rnn1-67ev
47
vulnerability VCID-vvhc-rnpr-ubey
48
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.6.17
aliases CVE-2025-32432, GHSA-f3gw-9ww9-jmc3
risk_score 10.0
exploitability 2.0
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qq68-3j4y-47am
20
url VCID-s5v6-e631-17f5
vulnerability_id VCID-s5v6-e631-17f5
summary 
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-30130
reference_id
reference_type
scores
0
value 0.07135
scoring_system epss
scoring_elements 0.9171
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-30130
1
reference_url https://craftcms.com
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://craftcms.com
2
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
3
reference_url https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-24T16:00:57Z/
url https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1
4
reference_url https://craftcms.com/
reference_id craftcms.com
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-24T16:00:57Z/
url https://craftcms.com/
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-30130
reference_id CVE-2023-30130
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-30130
6
reference_url https://github.com/advisories/GHSA-fjx5-xm7q-whvj
reference_id GHSA-fjx5-xm7q-whvj
reference_type
scores
url https://github.com/advisories/GHSA-fjx5-xm7q-whvj
fixed_packages
0
url pkg:composer/craftcms/cms@3.8.2
purl pkg:composer/craftcms/cms@3.8.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5mnd-qvaq-k3am
1
vulnerability VCID-5pur-jy1x-gfhv
2
vulnerability VCID-6hcd-ayyh-3fdb
3
vulnerability VCID-aajd-9qsf-37cr
4
vulnerability VCID-c2nk-y4rx-1qf4
5
vulnerability VCID-chep-xthg-zuee
6
vulnerability VCID-dz26-b2ts-puep
7
vulnerability VCID-ec34-nvn3-qbcb
8
vulnerability VCID-fpea-e48p-kfbn
9
vulnerability VCID-hkp9-3hzv-quhk
10
vulnerability VCID-hm7h-7cu3-8be1
11
vulnerability VCID-jhen-vhqx-n7dr
12
vulnerability VCID-jxet-d8ux-mkge
13
vulnerability VCID-qcwp-su57-9fa1
14
vulnerability VCID-qq68-3j4y-47am
15
vulnerability VCID-rb7c-3nkc-gkeg
16
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.8.2
aliases CVE-2023-30130, GHSA-fjx5-xm7q-whvj
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-s5v6-e631-17f5
21
url VCID-u4t8-gkkb-73bv
vulnerability_id VCID-u4t8-gkkb-73bv
summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms/cms.
references
0
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
1
reference_url https://github.com/advisories/GHSA-wf98-vxv9-jqfv
reference_id GHSA-wf98-vxv9-jqfv
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wf98-vxv9-jqfv
2
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-wf98-vxv9-jqfv
reference_id GHSA-wf98-vxv9-jqfv
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/security/advisories/GHSA-wf98-vxv9-jqfv
fixed_packages
0
url pkg:composer/craftcms/cms@3.7.29
purl pkg:composer/craftcms/cms@3.7.29
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-41y2-tucq-ykaj
1
vulnerability VCID-5mnd-qvaq-k3am
2
vulnerability VCID-5pur-jy1x-gfhv
3
vulnerability VCID-6hcd-ayyh-3fdb
4
vulnerability VCID-8pjj-w8h7-p7ga
5
vulnerability VCID-aajd-9qsf-37cr
6
vulnerability VCID-c2nk-y4rx-1qf4
7
vulnerability VCID-chep-xthg-zuee
8
vulnerability VCID-cwm6-qf1f-2keb
9
vulnerability VCID-dz26-b2ts-puep
10
vulnerability VCID-ec34-nvn3-qbcb
11
vulnerability VCID-eecq-8t4y-kka3
12
vulnerability VCID-fpea-e48p-kfbn
13
vulnerability VCID-hkp9-3hzv-quhk
14
vulnerability VCID-hm7h-7cu3-8be1
15
vulnerability VCID-jhen-vhqx-n7dr
16
vulnerability VCID-jxet-d8ux-mkge
17
vulnerability VCID-qcwp-su57-9fa1
18
vulnerability VCID-qq68-3j4y-47am
19
vulnerability VCID-rb7c-3nkc-gkeg
20
vulnerability VCID-s5v6-e631-17f5
21
vulnerability VCID-vbz3-3rqd-3fh6
22
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.29
aliases GHSA-wf98-vxv9-jqfv, GMS-2022-790
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u4t8-gkkb-73bv
22
url VCID-vbz3-3rqd-3fh6
vulnerability_id VCID-vbz3-3rqd-3fh6
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-30177
reference_id
reference_type
scores
0
value 0.00338
scoring_system epss
scoring_elements 0.56884
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-30177
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:24:49Z/
url https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-30177
reference_id CVE-2023-30177
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-30177
4
reference_url https://github.com/advisories/GHSA-wv7j-rc2q-9j67
reference_id GHSA-wv7j-rc2q-9j67
reference_type
scores
url https://github.com/advisories/GHSA-wv7j-rc2q-9j67
fixed_packages
0
url pkg:composer/craftcms/cms@3.7.68
purl pkg:composer/craftcms/cms@3.7.68
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5mnd-qvaq-k3am
1
vulnerability VCID-5pur-jy1x-gfhv
2
vulnerability VCID-6hcd-ayyh-3fdb
3
vulnerability VCID-aajd-9qsf-37cr
4
vulnerability VCID-c2nk-y4rx-1qf4
5
vulnerability VCID-chep-xthg-zuee
6
vulnerability VCID-dz26-b2ts-puep
7
vulnerability VCID-ec34-nvn3-qbcb
8
vulnerability VCID-fpea-e48p-kfbn
9
vulnerability VCID-hkp9-3hzv-quhk
10
vulnerability VCID-hm7h-7cu3-8be1
11
vulnerability VCID-jhen-vhqx-n7dr
12
vulnerability VCID-jxet-d8ux-mkge
13
vulnerability VCID-qcwp-su57-9fa1
14
vulnerability VCID-qq68-3j4y-47am
15
vulnerability VCID-rb7c-3nkc-gkeg
16
vulnerability VCID-s5v6-e631-17f5
17
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.68
aliases CVE-2023-30177, GHSA-wv7j-rc2q-9j67
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vbz3-3rqd-3fh6
23
url VCID-xc5n-1vqa-tqaz
vulnerability_id VCID-xc5n-1vqa-tqaz
summary 
Craft CMS Cross-site Scripting Vulnerability
An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-27902
reference_id
reference_type
scores
0
value 0.00419
scoring_system epss
scoring_elements 0.62273
published_at 2026-06-05T12:55:00Z
1
value 0.00419
scoring_system epss
scoring_elements 0.62224
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-27902
1
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26
2
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1
3
reference_url https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-27902
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-27902
fixed_packages
0
url pkg:composer/craftcms/cms@3.6.0
purl pkg:composer/craftcms/cms@3.6.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3r9x-ax4j-3yha
1
vulnerability VCID-41y2-tucq-ykaj
2
vulnerability VCID-5mnd-qvaq-k3am
3
vulnerability VCID-5pur-jy1x-gfhv
4
vulnerability VCID-6hcd-ayyh-3fdb
5
vulnerability VCID-8pjj-w8h7-p7ga
6
vulnerability VCID-aajd-9qsf-37cr
7
vulnerability VCID-c2nk-y4rx-1qf4
8
vulnerability VCID-c9mw-1at1-ebaz
9
vulnerability VCID-chep-xthg-zuee
10
vulnerability VCID-cwm6-qf1f-2keb
11
vulnerability VCID-dz26-b2ts-puep
12
vulnerability VCID-ec34-nvn3-qbcb
13
vulnerability VCID-eecq-8t4y-kka3
14
vulnerability VCID-fpea-e48p-kfbn
15
vulnerability VCID-hkp9-3hzv-quhk
16
vulnerability VCID-hm7h-7cu3-8be1
17
vulnerability VCID-jhen-vhqx-n7dr
18
vulnerability VCID-jxet-d8ux-mkge
19
vulnerability VCID-n1z8-7a8m-rfcc
20
vulnerability VCID-nz6e-26rc-f3fa
21
vulnerability VCID-qcwp-su57-9fa1
22
vulnerability VCID-qq68-3j4y-47am
23
vulnerability VCID-rb7c-3nkc-gkeg
24
vulnerability VCID-s5v6-e631-17f5
25
vulnerability VCID-u4t8-gkkb-73bv
26
vulnerability VCID-vbz3-3rqd-3fh6
27
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.0
aliases CVE-2021-27902, GHSA-3jxh-789f-p7m6
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xc5n-1vqa-tqaz
24
url VCID-xv52-rc7v-yba8
vulnerability_id VCID-xv52-rc7v-yba8
summary 
Injection Vulnerability
The `SEOmatic` component for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the `metacontainers` controller.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-9757
reference_id
reference_type
scores
0
value 0.94276
scoring_system epss
scoring_elements 0.99941
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-9757
1
reference_url https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt
2
reference_url https://github.com/nystudio107/craft-seomatic
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/nystudio107/craft-seomatic
3
reference_url https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md
4
reference_url https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b
5
reference_url https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-9757
reference_id CVE-2020-9757
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-9757
7
reference_url https://github.com/advisories/GHSA-6q4j-8pjm-5mgc
reference_id GHSA-6q4j-8pjm-5mgc
reference_type
scores
url https://github.com/advisories/GHSA-6q4j-8pjm-5mgc
fixed_packages
0
url pkg:composer/craftcms/cms@3.3.0
purl pkg:composer/craftcms/cms@3.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3r9x-ax4j-3yha
1
vulnerability VCID-41y2-tucq-ykaj
2
vulnerability VCID-5mnd-qvaq-k3am
3
vulnerability VCID-5pur-jy1x-gfhv
4
vulnerability VCID-6hcd-ayyh-3fdb
5
vulnerability VCID-8pjj-w8h7-p7ga
6
vulnerability VCID-aajd-9qsf-37cr
7
vulnerability VCID-adak-sn51-23gd
8
vulnerability VCID-c2nk-y4rx-1qf4
9
vulnerability VCID-cwm6-qf1f-2keb
10
vulnerability VCID-dz26-b2ts-puep
11
vulnerability VCID-ec34-nvn3-qbcb
12
vulnerability VCID-eecq-8t4y-kka3
13
vulnerability VCID-hm7h-7cu3-8be1
14
vulnerability VCID-jhen-vhqx-n7dr
15
vulnerability VCID-jxet-d8ux-mkge
16
vulnerability VCID-n1z8-7a8m-rfcc
17
vulnerability VCID-nz6e-26rc-f3fa
18
vulnerability VCID-qcwp-su57-9fa1
19
vulnerability VCID-qq68-3j4y-47am
20
vulnerability VCID-s5v6-e631-17f5
21
vulnerability VCID-u4t8-gkkb-73bv
22
vulnerability VCID-vbz3-3rqd-3fh6
23
vulnerability VCID-xc5n-1vqa-tqaz
24
vulnerability VCID-ymw8-mvrz-e7bc
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.3.0
aliases CVE-2020-9757, GHSA-6q4j-8pjm-5mgc
risk_score 10.0
exploitability 2.0
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xv52-rc7v-yba8
25
url VCID-ymw8-mvrz-e7bc
vulnerability_id VCID-ymw8-mvrz-e7bc
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2817
reference_id
reference_type
scores
0
value 0.00337
scoring_system epss
scoring_elements 0.56831
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2817
1
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
2
reference_url https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T15:47:46Z/
url https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb
3
reference_url https://www.tenable.com/security/research/tra-2023-20
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.tenable.com/security/research/tra-2023-20
4
reference_url https://www.tenable.com/security/research/tra-2023-20,
reference_id
reference_type
scores
url https://www.tenable.com/security/research/tra-2023-20,
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2817
reference_id CVE-2023-2817
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2817
6
reference_url https://www.tenable.com/security/research/tra-2023-20%2C
reference_id tra-2023-20%2C
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T15:47:46Z/
url https://www.tenable.com/security/research/tra-2023-20%2C
fixed_packages
0
url pkg:composer/craftcms/cms@4.4.12
purl pkg:composer/craftcms/cms@4.4.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-41uv-1axm-fugb
3
vulnerability VCID-4wkr-jx1w-77hn
4
vulnerability VCID-5cxe-tjpb-3qan
5
vulnerability VCID-5mnd-qvaq-k3am
6
vulnerability VCID-71sv-62m4-z3er
7
vulnerability VCID-7y4f-ef7t-47eb
8
vulnerability VCID-83rt-3tyj-qbgx
9
vulnerability VCID-8u2j-17a4-q7eh
10
vulnerability VCID-9ca4-tbhq-27ad
11
vulnerability VCID-9enr-b6zd-mbh8
12
vulnerability VCID-akrv-yqnf-1kg8
13
vulnerability VCID-azr5-12f8-hfbm
14
vulnerability VCID-c2nk-y4rx-1qf4
15
vulnerability VCID-chep-xthg-zuee
16
vulnerability VCID-cys8-jnmu-77ec
17
vulnerability VCID-dz26-b2ts-puep
18
vulnerability VCID-e94m-mj1k-8kbr
19
vulnerability VCID-eaxm-rjr7-xudb
20
vulnerability VCID-ec34-nvn3-qbcb
21
vulnerability VCID-efwv-r3nc-73h9
22
vulnerability VCID-f7gc-cgka-tycr
23
vulnerability VCID-fpea-e48p-kfbn
24
vulnerability VCID-fpke-p7sz-nfc9
25
vulnerability VCID-gzry-xtu5-ukhu
26
vulnerability VCID-h6t5-pdp5-8qhe
27
vulnerability VCID-hkp9-3hzv-quhk
28
vulnerability VCID-hyct-5gap-7kdu
29
vulnerability VCID-jeyh-3jxd-z3g6
30
vulnerability VCID-jhen-vhqx-n7dr
31
vulnerability VCID-jsfs-azcs-mfcm
32
vulnerability VCID-jxet-d8ux-mkge
33
vulnerability VCID-jxz8-g6fq-dubw
34
vulnerability VCID-kbrc-85av-nfcn
35
vulnerability VCID-m5rf-usae-yfb7
36
vulnerability VCID-nmzu-mefv-tqeh
37
vulnerability VCID-ppet-ruae-1kav
38
vulnerability VCID-qq68-3j4y-47am
39
vulnerability VCID-qwmy-d2e8-5khw
40
vulnerability VCID-qywv-vf4r-8bh9
41
vulnerability VCID-r5hp-5nju-9ubz
42
vulnerability VCID-rb7c-3nkc-gkeg
43
vulnerability VCID-rzq4-h1ms-nqef
44
vulnerability VCID-sa99-8awj-eycd
45
vulnerability VCID-twuy-wzb7-k7g3
46
vulnerability VCID-tzjk-x116-ayge
47
vulnerability VCID-vasz-rnn1-67ev
48
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.12
aliases CVE-2023-2817, GHSA-7x94-jx75-3gh6
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ymw8-mvrz-e7bc
Fixing_vulnerabilities
Risk_score10.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.2.0-alpha.6.3