Search for packages
| purl | pkg:composer/craftcms/cms@2.6.2780 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3n7p-999s-r3f3
Aliases: CVE-2017-8383 GHSA-7qq6-fgpw-xw45 |
File and Directory Information Exposure Craft CMS does not properly restrict viewing the contents of files in the `craft/app/` folder. |
Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-3twn-e7up-2ugq
Aliases: CVE-2018-20465 GHSA-j7fx-v37j-v3w7 |
Missing Encryption of Sensitive Data Craft CMS allows remote authenticated administrators to read sensitive information via server-side template injection which causes a cleartext username and password to be displayed in a URI field. |
Affected by 2 other vulnerabilities. |
|
VCID-97zb-4cxh-7yah
Aliases: CVE-2017-8385 GHSA-j27g-r58q-624w |
Weak Password Recovery Mechanism for Forgotten Password Craft CMS does not prevent modification of the URL in a forgot-password email message. |
Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-dgvz-qam7-23c1
Aliases: CVE-2017-9516 GHSA-6pvw-hh48-jx7p |
Cross-site Scripting Craft CMS allows for a potential XSS attack vector by uploading a malicious SVG file. |
Affected by 3 other vulnerabilities. |
|
VCID-hz6m-gqvb-6kae
Aliases: CVE-2017-8052 GHSA-xv5f-2997-qhrq |
Cross-site Scripting Craft CMS allows XSS attacks. |
Affected by 7 other vulnerabilities. |
|
VCID-mkab-fw34-ekh9
Aliases: CVE-2017-8384 GHSA-9mcw-mwxv-grwj |
Cross-site Scripting Craft CMS allows XSS attacks because an array returned by `HttpRequestService::getSegments()` and `getActionSegments()` need not be zero-based. |
Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-nz6e-26rc-f3fa
Aliases: CVE-2021-32470 GHSA-h2rj-8wgg-mm43 |
Cross-site Scripting Craft CMS has an XSS vulnerability. |
Affected by 0 other vulnerabilities. |
|
VCID-xv52-rc7v-yba8
Aliases: CVE-2020-9757 GHSA-6q4j-8pjm-5mgc |
Injection Vulnerability The `SEOmatic` component for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the `metacontainers` controller. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||