{"url":"http://public2.vulnerablecode.io/api/packages/413943?format=json","purl":"pkg:composer/craftcms/cms@2.0.2538","type":"composer","namespace":"craftcms","name":"cms","version":"2.0.2538","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"4.17.0-beta.1","latest_non_vulnerable_version":"5.9.18","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/208536?format=json","vulnerability_id":"VCID-118v-keeb-f7a6","summary":"Craft CMS Cross-site Scripting Vulnerability","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-32470","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56172","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-32470"},{"reference_url":"https://github.com/craftcms/cms/blob/3.6.13/CHANGELOG.md#security","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/3.6.13/CHANGELOG.md#security"},{"reference_url":"https://github.com/craftcms/cms/commit/f9378aa154b5f9b64bed3d59cce0c4a8184bf5e6","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/f9378aa154b5f9b64bed3d59cce0c4a8184bf5e6"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32470","reference_id":"CVE-2021-32470","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32470"},{"reference_url":"https://github.com/advisories/GHSA-h2rj-8wgg-mm43","reference_id":"GHSA-h2rj-8wgg-mm43","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h2rj-8wgg-mm43"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/19779?format=json","purl":"pkg:composer/craftcms/cms@3.6.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9wmc-pstb-ykfq"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-x6d2-n97u-8ke1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.13"}],"aliases":["CVE-2021-32470","GHSA-h2rj-8wgg-mm43"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-118v-keeb-f7a6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/296531?format=json","vulnerability_id":"VCID-1um9-4uaq-uuey","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8385","reference_id":"","reference_type":"","scores":[{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.52149","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8385"},{"reference_url":"https://craftcms.com/changelog#2-6-2976","reference_id":"","reference_type":"","scores":[],"url":"https://craftcms.com/changelog#2-6-2976"},{"reference_url":"https://github.com/craftcms/cms/blob/2.6.2976/CHANGELOG.md#security","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/2.6.2976/CHANGELOG.md#security"},{"reference_url":"https://github.com/craftcms/cms/commit/38c594badc8efc468b6162ec921d645011a50d35","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/38c594badc8efc468b6162ec921d645011a50d35"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8385","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8385"},{"reference_url":"https://twitter.com/CraftCMS/status/857743080224473088","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://twitter.com/CraftCMS/status/857743080224473088"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/389097?format=json","purl":"pkg:composer/craftcms/cms@2.6.2975","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-41nc-7j7y-y7fg"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-k9fu-3c3w-eubw"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-njef-qb7s-cub8"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-wjjk-6bpu-7qd8"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@2.6.2975"},{"url":"http://public2.vulnerablecode.io/api/packages/384874?format=json","purl":"pkg:composer/craftcms/cms@2.6.2976","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-41nc-7j7y-y7fg"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-k9fu-3c3w-eubw"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-njef-qb7s-cub8"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-wjjk-6bpu-7qd8"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@2.6.2976"}],"aliases":["CVE-2017-8385","GHSA-j27g-r58q-624w"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1um9-4uaq-uuey"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/209319?format=json","vulnerability_id":"VCID-3asf-kngu-ybf6","summary":"Improper account password reset in Craft CMS","references":[{"reference_url":"http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29933","reference_id":"","reference_type":"","scores":[{"value":"0.02319","scoring_system":"epss","scoring_elements":"0.85141","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29933"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md"},{"reference_url":"https://sec-consult.com/vulnerability-lab","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://sec-consult.com/vulnerability-lab"},{"reference_url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms"},{"reference_url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms/","reference_id":"","reference_type":"","scores":[],"url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29933","reference_id":"CVE-2022-29933","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29933"},{"reference_url":"https://github.com/advisories/GHSA-5cjr-78cq-3wrg","reference_id":"GHSA-5cjr-78cq-3wrg","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5cjr-78cq-3wrg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20848?format=json","purl":"pkg:composer/craftcms/cms@3.7.36","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.36"},{"url":"http://public2.vulnerablecode.io/api/packages/392449?format=json","purl":"pkg:composer/craftcms/cms@3.7.37","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.37"}],"aliases":["CVE-2022-29933","GHSA-5cjr-78cq-3wrg"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3asf-kngu-ybf6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/297242?format=json","vulnerability_id":"VCID-41nc-7j7y-y7fg","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-9516","reference_id":"","reference_type":"","scores":[{"value":"0.00791","scoring_system":"epss","scoring_elements":"0.74334","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-9516"},{"reference_url":"https://craftcms.com/changelog#2-6-2982","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://craftcms.com/changelog#2-6-2982"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9516","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9516"},{"reference_url":"https://packetstormsecurity.com/files/142851/Craft-CMS-2.6-Cross-Site-Scripting-File-Upload.html","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://packetstormsecurity.com/files/142851/Craft-CMS-2.6-Cross-Site-Scripting-File-Upload.html"},{"reference_url":"https://twitter.com/CraftCMS/status/872599894912937984","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://twitter.com/CraftCMS/status/872599894912937984"},{"reference_url":"https://www.exploit-db.com/exploits/42143","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/42143"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/42143.txt","reference_id":"CVE-2017-9516","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/42143.txt"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/386527?format=json","purl":"pkg:composer/craftcms/cms@2.6.2982","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-k9fu-3c3w-eubw"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-njef-qb7s-cub8"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-wjjk-6bpu-7qd8"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@2.6.2982"}],"aliases":["CVE-2017-9516","GHSA-6pvw-hh48-jx7p"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-41nc-7j7y-y7fg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/296310?format=json","vulnerability_id":"VCID-5b5t-esrd-5ygr","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8052","reference_id":"","reference_type":"","scores":[{"value":"0.00353","scoring_system":"epss","scoring_elements":"0.58053","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8052"},{"reference_url":"https://craftcms.com/changelog#2-6-2974","reference_id":"","reference_type":"","scores":[],"url":"https://craftcms.com/changelog#2-6-2974"},{"reference_url":"https://github.com/craftcms/cms/blob/2.6.2974/CHANGELOG.md#security","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/2.6.2974/CHANGELOG.md#security"},{"reference_url":"https://github.com/craftcms/cms/commit/f7e57018ff487d1ebbe375f6cb1852f4d79767ff","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/f7e57018ff487d1ebbe375f6cb1852f4d79767ff"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8052","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8052"},{"reference_url":"https://twitter.com/CraftCMS/status/855535309878112256","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://twitter.com/CraftCMS/status/855535309878112256"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/384550?format=json","purl":"pkg:composer/craftcms/cms@2.6.2974","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-1um9-4uaq-uuey"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-41nc-7j7y-y7fg"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-k9fu-3c3w-eubw"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-njef-qb7s-cub8"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-pej7-gg8z-dfhc"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-tjbx-u341-ykc4"},{"vulnerability":"VCID-wjjk-6bpu-7qd8"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@2.6.2974"}],"aliases":["CVE-2017-8052","GHSA-xv5f-2997-qhrq"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5b5t-esrd-5ygr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/332283?format=json","vulnerability_id":"VCID-8qus-7xen-hubb","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9757","reference_id":"","reference_type":"","scores":[{"value":"0.94276","scoring_system":"epss","scoring_elements":"0.99941","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9757"},{"reference_url":"https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt"},{"reference_url":"https://github.com/nystudio107/craft-seomatic","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic"},{"reference_url":"https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md"},{"reference_url":"https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b"},{"reference_url":"https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9757","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9757"},{"reference_url":"https://github.com/advisories/GHSA-6q4j-8pjm-5mgc","reference_id":"GHSA-6q4j-8pjm-5mgc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-6q4j-8pjm-5mgc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/455241?format=json","purl":"pkg:composer/craftcms/cms@3.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-x6d2-n97u-8ke1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.3.0"}],"aliases":["CVE-2020-9757","GHSA-6q4j-8pjm-5mgc"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8qus-7xen-hubb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/144141?format=json","vulnerability_id":"VCID-9yny-vu36-tyes","summary":"Craft CMS through 4.4.9 is vulnerable to HTML Injection.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33495","reference_id":"","reference_type":"","scores":[{"value":"0.00168","scoring_system":"epss","scoring_elements":"0.37785","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33495"},{"reference_url":"https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33495","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33495"},{"reference_url":"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection","reference_id":"03-Testing_for_HTML_Injection","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-09T21:12:01Z/"}],"url":"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection"},{"reference_url":"https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212","reference_id":"html-injection-in-craft-cms-application-e2b28f746212","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-09T21:12:01Z/"}],"url":"https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/393709?format=json","purl":"pkg:composer/craftcms/cms@4.4.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-726q-jfsa-9qdz"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-b25s-j3du-sfg5"},{"vulnerability":"VCID-c38g-6ttm-yuep"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-eypa-1c6q-tfau"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-gjvb-ht1w-s3hm"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-kb3b-8hqt-nqfj"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-p8kk-e27s-n7cs"},{"vulnerability":"VCID-pfwt-hxpb-4ub8"},{"vulnerability":"VCID-qrmg-jky7-87cb"},{"vulnerability":"VCID-r47n-36pn-cbe4"},{"vulnerability":"VCID-rezz-ka5s-hyg2"},{"vulnerability":"VCID-tfc8-rkdd-53f7"},{"vulnerability":"VCID-vrpf-parp-7kgr"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-wnr9-2wyr-wug4"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-y2ya-ys74-vqbv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.10"}],"aliases":["CVE-2023-33495","GHSA-m3v5-gjj9-rg24"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9yny-vu36-tyes"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/143897?format=json","vulnerability_id":"VCID-ad7v-5hxr-s3a4","summary":"Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33197","reference_id":"","reference_type":"","scores":[{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.75298","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33197"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33197","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33197"},{"reference_url":"https://github.com/craftcms/cms/releases/tag/4.4.6","reference_id":"4.4.6","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:32:08Z/"}],"url":"https://github.com/craftcms/cms/releases/tag/4.4.6"},{"reference_url":"https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766","reference_id":"8c2ad0bd313015b8ee42326af2848ee748f1d766","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:32:08Z/"}],"url":"https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766"},{"reference_url":"https://github.com/advisories/GHSA-6qjx-787v-6pxr","reference_id":"GHSA-6qjx-787v-6pxr","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-6qjx-787v-6pxr"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr","reference_id":"GHSA-6qjx-787v-6pxr","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:32:08Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381988?format=json","purl":"pkg:composer/craftcms/cms@4.4.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-726q-jfsa-9qdz"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9krv-seyq-juez"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-b25s-j3du-sfg5"},{"vulnerability":"VCID-c38g-6ttm-yuep"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-eypa-1c6q-tfau"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-gjvb-ht1w-s3hm"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-kb3b-8hqt-nqfj"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-p8kk-e27s-n7cs"},{"vulnerability":"VCID-pfwt-hxpb-4ub8"},{"vulnerability":"VCID-qrmg-jky7-87cb"},{"vulnerability":"VCID-r47n-36pn-cbe4"},{"vulnerability":"VCID-rezz-ka5s-hyg2"},{"vulnerability":"VCID-tfc8-rkdd-53f7"},{"vulnerability":"VCID-vrpf-parp-7kgr"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-wnr9-2wyr-wug4"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-y2ya-ys74-vqbv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.6"}],"aliases":["CVE-2023-33197","GHSA-6qjx-787v-6pxr"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ad7v-5hxr-s3a4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/129971?format=json","vulnerability_id":"VCID-aujg-14fc-1qeb","summary":"CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30177","reference_id":"","reference_type":"","scores":[{"value":"0.00338","scoring_system":"epss","scoring_elements":"0.56954","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30177"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30177","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30177"},{"reference_url":"https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e","reference_id":"00fb253d5318e10204433e5d93934108e574005e","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:24:49Z/"}],"url":"https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e"},{"reference_url":"https://github.com/advisories/GHSA-wv7j-rc2q-9j67","reference_id":"GHSA-wv7j-rc2q-9j67","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-wv7j-rc2q-9j67"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/379342?format=json","purl":"pkg:composer/craftcms/cms@3.7.68","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.68"}],"aliases":["CVE-2023-30177","GHSA-wv7j-rc2q-9j67"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-aujg-14fc-1qeb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/129860?format=json","vulnerability_id":"VCID-cneu-aazx-byfq","summary":"CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30179","reference_id":"","reference_type":"","scores":[{"value":"0.05499","scoring_system":"epss","scoring_elements":"0.90431","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30179"},{"reference_url":"https://github.com/github/advisory-database/pull/2443","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/github/advisory-database/pull/2443"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30179","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30179"},{"reference_url":"https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714","reference_id":"2443#issuecomment-1610040714","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/"}],"url":"https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714"},{"reference_url":"https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200","reference_id":"2443#issuecomment-1610634200","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/"}],"url":"https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14","reference_id":"CHANGELOG.md#442---2023-03-14","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/"}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14"},{"reference_url":"https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection","reference_id":"cve-2023-30179-server-side-template-injection","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/"}],"url":"https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381899?format=json","purl":"pkg:composer/craftcms/cms@4.4.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-726q-jfsa-9qdz"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9krv-seyq-juez"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-b25s-j3du-sfg5"},{"vulnerability":"VCID-c38g-6ttm-yuep"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-eypa-1c6q-tfau"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-gjvb-ht1w-s3hm"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-h3za-7cd7-vkav"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-kb3b-8hqt-nqfj"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-p8kk-e27s-n7cs"},{"vulnerability":"VCID-pfwt-hxpb-4ub8"},{"vulnerability":"VCID-qrmg-jky7-87cb"},{"vulnerability":"VCID-r47n-36pn-cbe4"},{"vulnerability":"VCID-rezz-ka5s-hyg2"},{"vulnerability":"VCID-tf8p-xrne-8qfg"},{"vulnerability":"VCID-tfc8-rkdd-53f7"},{"vulnerability":"VCID-vrpf-parp-7kgr"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-wnr9-2wyr-wug4"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-y2ya-ys74-vqbv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.2"}],"aliases":["CVE-2023-30179","GHSA-3x74-v64j-qc3f"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cneu-aazx-byfq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/129769?format=json","vulnerability_id":"VCID-e4ep-2ng5-1kbm","summary":"An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30130","reference_id":"","reference_type":"","scores":[{"value":"0.07135","scoring_system":"epss","scoring_elements":"0.91742","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30130"},{"reference_url":"https://craftcms.com","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://craftcms.com"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30130","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30130"},{"reference_url":"https://craftcms.com/","reference_id":"craftcms.com","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-24T16:00:57Z/"}],"url":"https://craftcms.com/"},{"reference_url":"https://github.com/advisories/GHSA-fjx5-xm7q-whvj","reference_id":"GHSA-fjx5-xm7q-whvj","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-fjx5-xm7q-whvj"},{"reference_url":"https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1","reference_id":"server-site-template-injection-on-craftcms-3.8.1","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-24T16:00:57Z/"}],"url":"https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/627173?format=json","purl":"pkg:composer/craftcms/cms@3.8.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.8.2"}],"aliases":["CVE-2023-30130","GHSA-fjx5-xm7q-whvj"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-e4ep-2ng5-1kbm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/105090?format=json","vulnerability_id":"VCID-fs3m-av1v-fuf1","summary":"Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-35939","reference_id":"","reference_type":"","scores":[{"value":"0.39398","scoring_system":"epss","scoring_elements":"0.9739","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-35939"},{"reference_url":"https://github.com/craftcms/cms/commit/e4c7bac8f31010aee048409f9ef6f744a83146b2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/e4c7bac8f31010aee048409f9ef6f744a83146b2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-35939","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-35939"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939"},{"reference_url":"https://github.com/craftcms/cms/pull/17220","reference_id":"17220","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/"}],"url":"https://github.com/craftcms/cms/pull/17220"},{"reference_url":"https://github.com/craftcms/cms/releases/tag/4.15.3","reference_id":"4.15.3","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/"}],"url":"https://github.com/craftcms/cms/releases/tag/4.15.3"},{"reference_url":"https://github.com/craftcms/cms/releases/tag/5.7.5","reference_id":"5.7.5","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/"}],"url":"https://github.com/craftcms/cms/releases/tag/5.7.5"},{"reference_url":"https://www.cve.org/CVERecord?id=CVE-2025-35939","reference_id":"CVERecord?id=CVE-2025-35939","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/"}],"url":"https://www.cve.org/CVERecord?id=CVE-2025-35939"},{"reference_url":"https://github.com/advisories/GHSA-7vrx-9684-xrf2","reference_id":"GHSA-7vrx-9684-xrf2","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-7vrx-9684-xrf2"},{"reference_url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json","reference_id":"va-25-147-01.json","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/"}],"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/40673?format=json","purl":"pkg:composer/craftcms/cms@4.15.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1c7e-bv58-33ax"},{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-726q-jfsa-9qdz"},{"vulnerability":"VCID-7mph-yq7h-5yb8"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9yzy-78sh-xydu"},{"vulnerability":"VCID-b25s-j3du-sfg5"},{"vulnerability":"VCID-bsh8-7q16-t7e4"},{"vulnerability":"VCID-f67g-n9d6-pkb5"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-p8kk-e27s-n7cs"},{"vulnerability":"VCID-qrmg-jky7-87cb"},{"vulnerability":"VCID-r47n-36pn-cbe4"},{"vulnerability":"VCID-rezz-ka5s-hyg2"},{"vulnerability":"VCID-tfc8-rkdd-53f7"},{"vulnerability":"VCID-vrpf-parp-7kgr"},{"vulnerability":"VCID-wnr9-2wyr-wug4"},{"vulnerability":"VCID-y2ya-ys74-vqbv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.15.3"},{"url":"http://public2.vulnerablecode.io/api/packages/40676?format=json","purl":"pkg:composer/craftcms/cms@5.7.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1c7e-bv58-33ax"},{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-726q-jfsa-9qdz"},{"vulnerability":"VCID-7mph-yq7h-5yb8"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9yzy-78sh-xydu"},{"vulnerability":"VCID-b25s-j3du-sfg5"},{"vulnerability":"VCID-bsh8-7q16-t7e4"},{"vulnerability":"VCID-f67g-n9d6-pkb5"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-p8kk-e27s-n7cs"},{"vulnerability":"VCID-qrmg-jky7-87cb"},{"vulnerability":"VCID-r47n-36pn-cbe4"},{"vulnerability":"VCID-rezz-ka5s-hyg2"},{"vulnerability":"VCID-tfc8-rkdd-53f7"},{"vulnerability":"VCID-uxc7-pe63-2khp"},{"vulnerability":"VCID-vrpf-parp-7kgr"},{"vulnerability":"VCID-wnr9-2wyr-wug4"},{"vulnerability":"VCID-y2ya-ys74-vqbv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.7.5"}],"aliases":["CVE-2025-35939","GHSA-7vrx-9684-xrf2"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fs3m-av1v-fuf1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/337919?format=json","vulnerability_id":"VCID-g7s1-n3qt-b3au","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27903","reference_id":"","reference_type":"","scores":[{"value":"0.03824","scoring_system":"epss","scoring_elements":"0.88398","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27903"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security"},{"reference_url":"https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27903","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27903"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/383150?format=json","purl":"pkg:composer/craftcms/cms@3.6.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9wmc-pstb-ykfq"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-x6d2-n97u-8ke1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.7"}],"aliases":["CVE-2021-27903","GHSA-x2j7-6hxm-87p3"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-g7s1-n3qt-b3au"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/151232?format=json","vulnerability_id":"VCID-hh13-6e1x-p7ez","summary":"A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-2817","reference_id":"","reference_type":"","scores":[{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56903","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-2817"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2817","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2817"},{"reference_url":"https://www.tenable.com/security/research/tra-2023-20","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.tenable.com/security/research/tra-2023-20"},{"reference_url":"https://www.tenable.com/security/research/tra-2023-20,","reference_id":"","reference_type":"","scores":[],"url":"https://www.tenable.com/security/research/tra-2023-20,"},{"reference_url":"https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb","reference_id":"7655e1009ba6cdbfb230e6bb138b775b69fc7bcb","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T15:47:46Z/"}],"url":"https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb"},{"reference_url":"https://www.tenable.com/security/research/tra-2023-20%2C","reference_id":"tra-2023-20%2C","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T15:47:46Z/"}],"url":"https://www.tenable.com/security/research/tra-2023-20%2C"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381957?format=json","purl":"pkg:composer/craftcms/cms@4.4.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-726q-jfsa-9qdz"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-b25s-j3du-sfg5"},{"vulnerability":"VCID-c38g-6ttm-yuep"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-eypa-1c6q-tfau"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-gjvb-ht1w-s3hm"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-kb3b-8hqt-nqfj"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-p8kk-e27s-n7cs"},{"vulnerability":"VCID-pfwt-hxpb-4ub8"},{"vulnerability":"VCID-qrmg-jky7-87cb"},{"vulnerability":"VCID-r47n-36pn-cbe4"},{"vulnerability":"VCID-rezz-ka5s-hyg2"},{"vulnerability":"VCID-tfc8-rkdd-53f7"},{"vulnerability":"VCID-vrpf-parp-7kgr"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-wnr9-2wyr-wug4"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-y2ya-ys74-vqbv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.12"}],"aliases":["CVE-2023-2817","GHSA-7x94-jx75-3gh6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hh13-6e1x-p7ez"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45395?format=json","vulnerability_id":"VCID-k8na-x3nm-hkav","summary":"Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37843","reference_id":"","reference_type":"","scores":[{"value":"0.89433","scoring_system":"epss","scoring_elements":"0.99568","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37843"},{"reference_url":"https://blog.smithsecurity.biz/craft-cms-unauthenticated-sqli-via-graphql","reference_id":"craft-cms-unauthenticated-sqli-via-graphql","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-12T22:53:54Z/"}],"url":"https://blog.smithsecurity.biz/craft-cms-unauthenticated-sqli-via-graphql"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37843","reference_id":"CVE-2024-37843","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37843"},{"reference_url":"https://github.com/advisories/GHSA-hq4f-mv3q-8wcv","reference_id":"GHSA-hq4f-mv3q-8wcv","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hq4f-mv3q-8wcv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/28137?format=json","purl":"pkg:composer/craftcms/cms@3.7.32","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.32"}],"aliases":["CVE-2024-37843","GHSA-hq4f-mv3q-8wcv"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k8na-x3nm-hkav"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/136303?format=json","vulnerability_id":"VCID-k9fu-3c3w-eubw","summary":"Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36259","reference_id":"","reference_type":"","scores":[{"value":"0.00087","scoring_system":"epss","scoring_elements":"0.25051","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36259"},{"reference_url":"https://github.com/sjelfull/craft-audit","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sjelfull/craft-audit"},{"reference_url":"https://github.com/sjelfull/craft-audit/commit/c2888aa48457f24696ac0a2ba4f54f39e5c672ed","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sjelfull/craft-audit/commit/c2888aa48457f24696ac0a2ba4f54f39e5c672ed"},{"reference_url":"https://github.com/sjelfull/craft-audit/pull/73","reference_id":"73","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T17:35:02Z/"}],"url":"https://github.com/sjelfull/craft-audit/pull/73"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36259","reference_id":"CVE-2023-36259","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36259"},{"reference_url":"https://github.com/advisories/GHSA-v89q-c273-3p42","reference_id":"GHSA-v89q-c273-3p42","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v89q-c273-3p42"},{"reference_url":"https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D","reference_id":"?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T17:35:02Z/"}],"url":"https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/394996?format=json","purl":"pkg:composer/craftcms/cms@3.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-njef-qb7s-cub8"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-wjjk-6bpu-7qd8"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.0.2"}],"aliases":["CVE-2023-36259","GHSA-v89q-c273-3p42"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k9fu-3c3w-eubw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/136517?format=json","vulnerability_id":"VCID-mhqg-hey8-6bee","summary":"An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has \"nothing to do with security.\"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36260","reference_id":"","reference_type":"","scores":[{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.59001","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36260"},{"reference_url":"https://github.com/craftcms/feed-me","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/feed-me"},{"reference_url":"https://github.com/craftcms/feed-me/releases/tag/4.6.2","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/feed-me/releases/tag/4.6.2"},{"reference_url":"https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28","reference_id":"b5d6ede51848349bd91bc95fec288b6793f15e28","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-30T16:40:39Z/"}],"url":"https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28"},{"reference_url":"https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29","reference_id":"b5d6ede51848349bd91bc95fec288b6793f15e28%29","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-30T16:40:39Z/"}],"url":"https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36260","reference_id":"CVE-2023-36260","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36260"},{"reference_url":"https://github.com/advisories/GHSA-6p78-f7h9-6838","reference_id":"GHSA-6p78-f7h9-6838","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6p78-f7h9-6838"},{"reference_url":"https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D","reference_id":"?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-30T16:40:39Z/"}],"url":"https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/28616?format=json","purl":"pkg:composer/craftcms/cms@4.6.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.6.2"},{"url":"http://public2.vulnerablecode.io/api/packages/394995?format=json","purl":"pkg:composer/craftcms/cms@4.7.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1c7e-bv58-33ax"},{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-726q-jfsa-9qdz"},{"vulnerability":"VCID-7mph-yq7h-5yb8"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-b25s-j3du-sfg5"},{"vulnerability":"VCID-bsh8-7q16-t7e4"},{"vulnerability":"VCID-c38g-6ttm-yuep"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-eypa-1c6q-tfau"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-kb3b-8hqt-nqfj"},{"vulnerability":"VCID-p8kk-e27s-n7cs"},{"vulnerability":"VCID-pfwt-hxpb-4ub8"},{"vulnerability":"VCID-qrmg-jky7-87cb"},{"vulnerability":"VCID-r47n-36pn-cbe4"},{"vulnerability":"VCID-rezz-ka5s-hyg2"},{"vulnerability":"VCID-tfc8-rkdd-53f7"},{"vulnerability":"VCID-vrpf-parp-7kgr"},{"vulnerability":"VCID-wnr9-2wyr-wug4"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-y2ya-ys74-vqbv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.7.0"}],"aliases":["CVE-2023-36260","GHSA-6p78-f7h9-6838"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mhqg-hey8-6bee"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/337918?format=json","vulnerability_id":"VCID-nfvy-nma3-6qbp","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27902","reference_id":"","reference_type":"","scores":[{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.62334","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27902"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1"},{"reference_url":"https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27902","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27902"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/383183?format=json","purl":"pkg:composer/craftcms/cms@3.6.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9wmc-pstb-ykfq"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-x6d2-n97u-8ke1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.0"}],"aliases":["CVE-2021-27902","GHSA-3jxh-789f-p7m6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nfvy-nma3-6qbp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/304446?format=json","vulnerability_id":"VCID-njef-qb7s-cub8","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-20465","reference_id":"","reference_type":"","scores":[{"value":"0.00664","scoring_system":"epss","scoring_elements":"0.7167","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-20465"},{"reference_url":"https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md"},{"reference_url":"https://github.com/phuctam/Server-Side-Template-Injection-in-CraftCMS-/issues/1","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/phuctam/Server-Side-Template-Injection-in-CraftCMS-/issues/1"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20465","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20465"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/390949?format=json","purl":"pkg:composer/craftcms/cms@3.0.35","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-wjjk-6bpu-7qd8"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.0.35"}],"aliases":["CVE-2018-20465","GHSA-j7fx-v37j-v3w7"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-njef-qb7s-cub8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/313127?format=json","vulnerability_id":"VCID-pdt2-ckb1-z3a8","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-17496","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56172","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-17496"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09"},{"reference_url":"https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17496","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17496"},{"reference_url":"https://github.com/advisories/GHSA-f3xr-q258-h7m9","reference_id":"GHSA-f3xr-q258-h7m9","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-f3xr-q258-h7m9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/385585?format=json","purl":"pkg:composer/craftcms/cms@3.3.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-x6d2-n97u-8ke1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.3.8"}],"aliases":["CVE-2019-17496","GHSA-f3xr-q258-h7m9"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pdt2-ckb1-z3a8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/296530?format=json","vulnerability_id":"VCID-pej7-gg8z-dfhc","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8384","reference_id":"","reference_type":"","scores":[{"value":"0.00307","scoring_system":"epss","scoring_elements":"0.54318","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8384"},{"reference_url":"https://craftcms.com/changelog#2-6-2976","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://craftcms.com/changelog#2-6-2976"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8384","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8384"},{"reference_url":"https://twitter.com/CraftCMS/status/857743080224473088","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://twitter.com/CraftCMS/status/857743080224473088"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/389097?format=json","purl":"pkg:composer/craftcms/cms@2.6.2975","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-41nc-7j7y-y7fg"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-k9fu-3c3w-eubw"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-njef-qb7s-cub8"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-wjjk-6bpu-7qd8"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@2.6.2975"},{"url":"http://public2.vulnerablecode.io/api/packages/384874?format=json","purl":"pkg:composer/craftcms/cms@2.6.2976","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-41nc-7j7y-y7fg"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-k9fu-3c3w-eubw"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-njef-qb7s-cub8"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-wjjk-6bpu-7qd8"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@2.6.2976"}],"aliases":["CVE-2017-8384","GHSA-9mcw-mwxv-grwj"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pej7-gg8z-dfhc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/208693?format=json","vulnerability_id":"VCID-sdtn-nzaq-e3cb","summary":"XSS Injection Vulnerability","references":[{"reference_url":"https://github.com/advisories/GHSA-wf98-vxv9-jqfv","reference_id":"GHSA-wf98-vxv9-jqfv","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wf98-vxv9-jqfv"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-wf98-vxv9-jqfv","reference_id":"GHSA-wf98-vxv9-jqfv","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-wf98-vxv9-jqfv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20005?format=json","purl":"pkg:composer/craftcms/cms@3.7.29","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.29"}],"aliases":["GHSA-wf98-vxv9-jqfv","GMS-2022-790"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sdtn-nzaq-e3cb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/130319?format=json","vulnerability_id":"VCID-t37k-f7k1-gyhz","summary":"Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-23927","reference_id":"","reference_type":"","scores":[{"value":"0.02749","scoring_system":"epss","scoring_elements":"0.8632","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-23927"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23927","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23927"},{"reference_url":"https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4","reference_id":"215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:30:35Z/"}],"url":"https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03","reference_id":"CHANGELOG.md#437---2023-02-03","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:30:35Z/"}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03"},{"reference_url":"https://github.com/advisories/GHSA-qcrj-6ffc-v7hq","reference_id":"GHSA-qcrj-6ffc-v7hq","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-qcrj-6ffc-v7hq"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq","reference_id":"GHSA-qcrj-6ffc-v7hq","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:30:35Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/380973?format=json","purl":"pkg:composer/craftcms/cms@3.7.64","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.64"},{"url":"http://public2.vulnerablecode.io/api/packages/380972?format=json","purl":"pkg:composer/craftcms/cms@4.3.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-726q-jfsa-9qdz"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9krv-seyq-juez"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-b25s-j3du-sfg5"},{"vulnerability":"VCID-c38g-6ttm-yuep"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-eypa-1c6q-tfau"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-gjvb-ht1w-s3hm"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-h3za-7cd7-vkav"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-kb3b-8hqt-nqfj"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-p8kk-e27s-n7cs"},{"vulnerability":"VCID-pfwt-hxpb-4ub8"},{"vulnerability":"VCID-qrmg-jky7-87cb"},{"vulnerability":"VCID-r47n-36pn-cbe4"},{"vulnerability":"VCID-rezz-ka5s-hyg2"},{"vulnerability":"VCID-tf8p-xrne-8qfg"},{"vulnerability":"VCID-tfc8-rkdd-53f7"},{"vulnerability":"VCID-vrpf-parp-7kgr"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-wnr9-2wyr-wug4"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-y2ya-ys74-vqbv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.3.7"}],"aliases":["CVE-2023-23927","GHSA-qcrj-6ffc-v7hq"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-t37k-f7k1-gyhz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/296529?format=json","vulnerability_id":"VCID-tjbx-u341-ykc4","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8383","reference_id":"","reference_type":"","scores":[{"value":"0.00316","scoring_system":"epss","scoring_elements":"0.55132","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8383"},{"reference_url":"https://craftcms.com/changelog#2-6-2976","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://craftcms.com/changelog#2-6-2976"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8383","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8383"},{"reference_url":"https://twitter.com/CraftCMS/status/857743080224473088","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://twitter.com/CraftCMS/status/857743080224473088"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/389097?format=json","purl":"pkg:composer/craftcms/cms@2.6.2975","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-41nc-7j7y-y7fg"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-k9fu-3c3w-eubw"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-njef-qb7s-cub8"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-wjjk-6bpu-7qd8"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@2.6.2975"},{"url":"http://public2.vulnerablecode.io/api/packages/384874?format=json","purl":"pkg:composer/craftcms/cms@2.6.2976","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-41nc-7j7y-y7fg"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-k9fu-3c3w-eubw"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-njef-qb7s-cub8"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-wjjk-6bpu-7qd8"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@2.6.2976"}],"aliases":["CVE-2017-8383","GHSA-7qq6-fgpw-xw45"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tjbx-u341-ykc4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/312375?format=json","vulnerability_id":"VCID-wjjk-6bpu-7qd8","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-15929","reference_id":"","reference_type":"","scores":[{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58426","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-15929"},{"reference_url":"https://github.com/craftcms/cms/blob/3.1.7/CHANGELOG-v3.md","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/3.1.7/CHANGELOG-v3.md"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15929","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15929"},{"reference_url":"https://github.com/advisories/GHSA-wvr4-w6cw-4px8","reference_id":"GHSA-wvr4-w6cw-4px8","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-wvr4-w6cw-4px8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/385441?format=json","purl":"pkg:composer/craftcms/cms@3.1.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-x6d2-n97u-8ke1"},{"vulnerability":"VCID-xk93-69dj-9ufm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.1.7"}],"aliases":["CVE-2019-15929","GHSA-wvr4-w6cw-4px8"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wjjk-6bpu-7qd8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/208683?format=json","vulnerability_id":"VCID-x6d2-n97u-8ke1","summary":"Cross-site Scripting in craftcms/cms","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-28378","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56172","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-28378"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18"},{"reference_url":"https://github.com/craftcms/cms/commit/7ca2b2d2ccecfb524525afc8ceac6f6e44f84b88","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/7ca2b2d2ccecfb524525afc8ceac6f6e44f84b88"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28378","reference_id":"CVE-2022-28378","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28378"},{"reference_url":"https://github.com/advisories/GHSA-7xj5-fwqr-5378","reference_id":"GHSA-7xj5-fwqr-5378","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7xj5-fwqr-5378"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20005?format=json","purl":"pkg:composer/craftcms/cms@3.7.29","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-543c-646v-4yfj"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8m8v-ymqs-fkh9"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-grmm-88sf-wyd4"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-htqk-ckr5-jbcu"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.29"}],"aliases":["CVE-2022-28378","GHSA-7xj5-fwqr-5378"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x6d2-n97u-8ke1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/310706?format=json","vulnerability_id":"VCID-xk93-69dj-9ufm","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-12823","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56172","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-12823"},{"reference_url":"https://github.com/craftcms/cms/blob/6432eca59b93bcea2ca2616199e5d419447e613f/CHANGELOG-v3.md","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/6432eca59b93bcea2ca2616199e5d419447e613f/CHANGELOG-v3.md"},{"reference_url":"https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12823","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12823"},{"reference_url":"https://github.com/advisories/GHSA-w5q4-q7wp-qww6","reference_id":"GHSA-w5q4-q7wp-qww6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-w5q4-q7wp-qww6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/384907?format=json","purl":"pkg:composer/craftcms/cms@3.1.31","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-118v-keeb-f7a6"},{"vulnerability":"VCID-3asf-kngu-ybf6"},{"vulnerability":"VCID-5r1t-9sdm-j3cf"},{"vulnerability":"VCID-8kdh-rvh3-4yfv"},{"vulnerability":"VCID-8qus-7xen-hubb"},{"vulnerability":"VCID-9fqv-dg3y-wbbf"},{"vulnerability":"VCID-9yny-vu36-tyes"},{"vulnerability":"VCID-a9bc-cgqq-jkfh"},{"vulnerability":"VCID-ad7v-5hxr-s3a4"},{"vulnerability":"VCID-aujg-14fc-1qeb"},{"vulnerability":"VCID-cneu-aazx-byfq"},{"vulnerability":"VCID-czuy-m8wp-fka2"},{"vulnerability":"VCID-e4ep-2ng5-1kbm"},{"vulnerability":"VCID-fs3m-av1v-fuf1"},{"vulnerability":"VCID-g7s1-n3qt-b3au"},{"vulnerability":"VCID-hh13-6e1x-p7ez"},{"vulnerability":"VCID-jwj3-be5u-cfa6"},{"vulnerability":"VCID-k8na-x3nm-hkav"},{"vulnerability":"VCID-mhqg-hey8-6bee"},{"vulnerability":"VCID-nfvy-nma3-6qbp"},{"vulnerability":"VCID-pdt2-ckb1-z3a8"},{"vulnerability":"VCID-sdtn-nzaq-e3cb"},{"vulnerability":"VCID-t37k-f7k1-gyhz"},{"vulnerability":"VCID-vvej-1fex-kqdn"},{"vulnerability":"VCID-wcsx-j8xk-r7c7"},{"vulnerability":"VCID-x12b-mjr9-sba2"},{"vulnerability":"VCID-x6d2-n97u-8ke1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.1.31"}],"aliases":["CVE-2019-12823","GHSA-w5q4-q7wp-qww6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xk93-69dj-9ufm"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@2.0.2538"}