{"url":"http://public2.vulnerablecode.io/api/packages/229535?format=json","purl":"pkg:composer/craftcms/cms@3.0.0-RC8","type":"composer","namespace":"craftcms","name":"cms","version":"3.0.0-RC8","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"3.7.33","latest_non_vulnerable_version":"5.9.18","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42836?format=json","vulnerability_id":"VCID-3r9x-ax4j-3yha","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCraft CMS before 3.7.29 allows XSS.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-28378","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56045","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.561","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-28378"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18"},{"reference_url":"https://github.com/craftcms/cms/commit/7ca2b2d2ccecfb524525afc8ceac6f6e44f84b88","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/7ca2b2d2ccecfb524525afc8ceac6f6e44f84b88"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28378","reference_id":"CVE-2022-28378","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28378"},{"reference_url":"https://github.com/advisories/GHSA-7xj5-fwqr-5378","reference_id":"GHSA-7xj5-fwqr-5378","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7xj5-fwqr-5378"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61257?format=json","purl":"pkg:composer/craftcms/cms@3.7.29","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-8pjj-w8h7-p7ga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.29"}],"aliases":["CVE-2022-28378","GHSA-7xj5-fwqr-5378"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3r9x-ax4j-3yha"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/40555?format=json","vulnerability_id":"VCID-3twn-e7up-2ugq","summary":"Missing Encryption of Sensitive Data\nCraft CMS allows remote authenticated administrators to read sensitive information via server-side template injection which causes a cleartext username and password to be displayed in a URI field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-20465","reference_id":"","reference_type":"","scores":[{"value":"0.00664","scoring_system":"epss","scoring_elements":"0.71581","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00664","scoring_system":"epss","scoring_elements":"0.71626","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-20465"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md"},{"reference_url":"https://github.com/phuctam/Server-Side-Template-Injection-in-CraftCMS-/issues/1","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/phuctam/Server-Side-Template-Injection-in-CraftCMS-/issues/1"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20465","reference_id":"CVE-2018-20465","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20465"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57237?format=json","purl":"pkg:composer/craftcms/cms@3.0.35","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3r9x-ax4j-3yha"},{"vulnerability":"VCID-8pjj-w8h7-p7ga"},{"vulnerability":"VCID-9kjs-xj6x-y3gb"},{"vulnerability":"VCID-adak-sn51-23gd"},{"vulnerability":"VCID-n1z8-7a8m-rfcc"},{"vulnerability":"VCID-nz6e-26rc-f3fa"},{"vulnerability":"VCID-rx96-8kfy-4ugu"},{"vulnerability":"VCID-u4t8-gkkb-73bv"},{"vulnerability":"VCID-xc5n-1vqa-tqaz"},{"vulnerability":"VCID-xv52-rc7v-yba8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.0.35"}],"aliases":["CVE-2018-20465","GHSA-j7fx-v37j-v3w7"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3twn-e7up-2ugq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43304?format=json","vulnerability_id":"VCID-8pjj-w8h7-p7ga","summary":"Weak Password Recovery Mechanism for Forgotten Password\nCraft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).","references":[{"reference_url":"http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29933","reference_id":"","reference_type":"","scores":[{"value":"0.02319","scoring_system":"epss","scoring_elements":"0.85111","published_at":"2026-06-05T12:55:00Z"},{"value":"0.02319","scoring_system":"epss","scoring_elements":"0.85087","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29933"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md"},{"reference_url":"https://sec-consult.com/vulnerability-lab","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://sec-consult.com/vulnerability-lab"},{"reference_url":"https://sec-consult.com/vulnerability-lab/","reference_id":"","reference_type":"","scores":[],"url":"https://sec-consult.com/vulnerability-lab/"},{"reference_url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms"},{"reference_url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms/","reference_id":"","reference_type":"","scores":[],"url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29933","reference_id":"CVE-2022-29933","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29933"},{"reference_url":"https://github.com/advisories/GHSA-5cjr-78cq-3wrg","reference_id":"GHSA-5cjr-78cq-3wrg","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5cjr-78cq-3wrg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62010?format=json","purl":"pkg:composer/craftcms/cms@3.7.36","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-8pjj-w8h7-p7ga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.36"},{"url":"http://public2.vulnerablecode.io/api/packages/62011?format=json","purl":"pkg:composer/craftcms/cms@3.7.37","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.37"}],"aliases":["CVE-2022-29933","GHSA-5cjr-78cq-3wrg"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8pjj-w8h7-p7ga"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/111130?format=json","vulnerability_id":"VCID-9kjs-xj6x-y3gb","summary":"Craft CMS XSS Vulnerability\nCraft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-12823","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56045","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.561","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-12823"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/6432eca59b93bcea2ca2616199e5d419447e613f/CHANGELOG-v3.md","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/6432eca59b93bcea2ca2616199e5d419447e613f/CHANGELOG-v3.md"},{"reference_url":"https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12823","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12823"},{"reference_url":"https://github.com/advisories/GHSA-w5q4-q7wp-qww6","reference_id":"GHSA-w5q4-q7wp-qww6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-w5q4-q7wp-qww6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/80119?format=json","purl":"pkg:composer/craftcms/cms@3.1.31","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3r9x-ax4j-3yha"},{"vulnerability":"VCID-8pjj-w8h7-p7ga"},{"vulnerability":"VCID-adak-sn51-23gd"},{"vulnerability":"VCID-n1z8-7a8m-rfcc"},{"vulnerability":"VCID-nz6e-26rc-f3fa"},{"vulnerability":"VCID-u4t8-gkkb-73bv"},{"vulnerability":"VCID-uamr-mmjj-ryhc"},{"vulnerability":"VCID-xc5n-1vqa-tqaz"},{"vulnerability":"VCID-xv52-rc7v-yba8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.1.31"}],"aliases":["CVE-2019-12823","GHSA-w5q4-q7wp-qww6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9kjs-xj6x-y3gb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/111482?format=json","vulnerability_id":"VCID-adak-sn51-23gd","summary":"Craft CMS XSS Vulnerability\nCraft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-17496","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56045","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.561","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-17496"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09"},{"reference_url":"https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17496","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17496"},{"reference_url":"https://github.com/advisories/GHSA-f3xr-q258-h7m9","reference_id":"GHSA-f3xr-q258-h7m9","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-f3xr-q258-h7m9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/152899?format=json","purl":"pkg:composer/craftcms/cms@3.3.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3r9x-ax4j-3yha"},{"vulnerability":"VCID-8pjj-w8h7-p7ga"},{"vulnerability":"VCID-n1z8-7a8m-rfcc"},{"vulnerability":"VCID-nz6e-26rc-f3fa"},{"vulnerability":"VCID-u4t8-gkkb-73bv"},{"vulnerability":"VCID-xc5n-1vqa-tqaz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.3.8"}],"aliases":["CVE-2019-17496","GHSA-f3xr-q258-h7m9"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-adak-sn51-23gd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/108321?format=json","vulnerability_id":"VCID-n1z8-7a8m-rfcc","summary":"Craft CMS Remote Code Injection\nAn issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27903","reference_id":"","reference_type":"","scores":[{"value":"0.03824","scoring_system":"epss","scoring_elements":"0.8836","published_at":"2026-06-05T12:55:00Z"},{"value":"0.03824","scoring_system":"epss","scoring_elements":"0.88342","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27903"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security"},{"reference_url":"https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27903","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27903"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/142121?format=json","purl":"pkg:composer/craftcms/cms@3.6.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3r9x-ax4j-3yha"},{"vulnerability":"VCID-8pjj-w8h7-p7ga"},{"vulnerability":"VCID-c9mw-1at1-ebaz"},{"vulnerability":"VCID-nz6e-26rc-f3fa"},{"vulnerability":"VCID-u4t8-gkkb-73bv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.7"}],"aliases":["CVE-2021-27903","GHSA-x2j7-6hxm-87p3"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n1z8-7a8m-rfcc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54460?format=json","vulnerability_id":"VCID-nz6e-26rc-f3fa","summary":"Cross-site Scripting\nCraft CMS has an XSS vulnerability.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-32470","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56045","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.561","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-32470"},{"reference_url":"https://github.com/craftcms/cms/blob/3.6.13/CHANGELOG.md#security","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/3.6.13/CHANGELOG.md#security"},{"reference_url":"https://github.com/craftcms/cms/commit/f9378aa154b5f9b64bed3d59cce0c4a8184bf5e6","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/f9378aa154b5f9b64bed3d59cce0c4a8184bf5e6"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32470","reference_id":"CVE-2021-32470","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32470"},{"reference_url":"https://github.com/advisories/GHSA-h2rj-8wgg-mm43","reference_id":"GHSA-h2rj-8wgg-mm43","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h2rj-8wgg-mm43"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/80685?format=json","purl":"pkg:composer/craftcms/cms@3.6.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3r9x-ax4j-3yha"},{"vulnerability":"VCID-8pjj-w8h7-p7ga"},{"vulnerability":"VCID-c9mw-1at1-ebaz"},{"vulnerability":"VCID-u4t8-gkkb-73bv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.13"}],"aliases":["CVE-2021-32470","GHSA-h2rj-8wgg-mm43"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nz6e-26rc-f3fa"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/111429?format=json","vulnerability_id":"VCID-rx96-8kfy-4ugu","summary":"Craft CMS possibility of brute force attempts\nIn Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-15929","reference_id":"","reference_type":"","scores":[{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58308","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58355","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-15929"},{"reference_url":"https://github.com/craftcms/cms/blob/3.1.7/CHANGELOG-v3.md","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/3.1.7/CHANGELOG-v3.md"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15929","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15929"},{"reference_url":"https://github.com/advisories/GHSA-wvr4-w6cw-4px8","reference_id":"GHSA-wvr4-w6cw-4px8","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-wvr4-w6cw-4px8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/152502?format=json","purl":"pkg:composer/craftcms/cms@3.1.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3r9x-ax4j-3yha"},{"vulnerability":"VCID-8pjj-w8h7-p7ga"},{"vulnerability":"VCID-9kjs-xj6x-y3gb"},{"vulnerability":"VCID-adak-sn51-23gd"},{"vulnerability":"VCID-n1z8-7a8m-rfcc"},{"vulnerability":"VCID-nz6e-26rc-f3fa"},{"vulnerability":"VCID-u4t8-gkkb-73bv"},{"vulnerability":"VCID-xc5n-1vqa-tqaz"},{"vulnerability":"VCID-xv52-rc7v-yba8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.1.7"}],"aliases":["CVE-2019-15929","GHSA-wvr4-w6cw-4px8"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rx96-8kfy-4ugu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42840?format=json","vulnerability_id":"VCID-u4t8-gkkb-73bv","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms/cms.","references":[{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/advisories/GHSA-wf98-vxv9-jqfv","reference_id":"GHSA-wf98-vxv9-jqfv","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wf98-vxv9-jqfv"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-wf98-vxv9-jqfv","reference_id":"GHSA-wf98-vxv9-jqfv","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-wf98-vxv9-jqfv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61257?format=json","purl":"pkg:composer/craftcms/cms@3.7.29","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-8pjj-w8h7-p7ga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.29"}],"aliases":["GHSA-wf98-vxv9-jqfv","GMS-2022-790"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-u4t8-gkkb-73bv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/108329?format=json","vulnerability_id":"VCID-xc5n-1vqa-tqaz","summary":"Craft CMS Cross-site Scripting Vulnerability\nAn issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27902","reference_id":"","reference_type":"","scores":[{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.62273","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.62224","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27902"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1"},{"reference_url":"https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27902","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27902"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/142146?format=json","purl":"pkg:composer/craftcms/cms@3.6.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3r9x-ax4j-3yha"},{"vulnerability":"VCID-8pjj-w8h7-p7ga"},{"vulnerability":"VCID-c9mw-1at1-ebaz"},{"vulnerability":"VCID-n1z8-7a8m-rfcc"},{"vulnerability":"VCID-nz6e-26rc-f3fa"},{"vulnerability":"VCID-u4t8-gkkb-73bv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.0"}],"aliases":["CVE-2021-27902","GHSA-3jxh-789f-p7m6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xc5n-1vqa-tqaz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/52307?format=json","vulnerability_id":"VCID-xv52-rc7v-yba8","summary":"Injection Vulnerability\nThe `SEOmatic` component for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the `metacontainers` controller.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9757","reference_id":"","reference_type":"","scores":[{"value":"0.94276","scoring_system":"epss","scoring_elements":"0.99941","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9757"},{"reference_url":"https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt"},{"reference_url":"https://github.com/nystudio107/craft-seomatic","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic"},{"reference_url":"https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md"},{"reference_url":"https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b"},{"reference_url":"https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9757","reference_id":"CVE-2020-9757","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9757"},{"reference_url":"https://github.com/advisories/GHSA-6q4j-8pjm-5mgc","reference_id":"GHSA-6q4j-8pjm-5mgc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-6q4j-8pjm-5mgc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/76817?format=json","purl":"pkg:composer/craftcms/cms@3.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3r9x-ax4j-3yha"},{"vulnerability":"VCID-8pjj-w8h7-p7ga"},{"vulnerability":"VCID-adak-sn51-23gd"},{"vulnerability":"VCID-n1z8-7a8m-rfcc"},{"vulnerability":"VCID-nz6e-26rc-f3fa"},{"vulnerability":"VCID-u4t8-gkkb-73bv"},{"vulnerability":"VCID-xc5n-1vqa-tqaz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.3.0"}],"aliases":["CVE-2020-9757","GHSA-6q4j-8pjm-5mgc"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xv52-rc7v-yba8"}],"fixing_vulnerabilities":[],"risk_score":"10.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.0.0-RC8"}