{"url":"http://public2.vulnerablecode.io/api/packages/442592?format=json","purl":"pkg:composer/craftcms/cms@3.1.28","type":"composer","namespace":"craftcms","name":"cms","version":"3.1.28","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"4.17.9","latest_non_vulnerable_version":"5.9.18","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/34342?format=json","vulnerability_id":"VCID-1q7e-qqs4-1kfu","summary":"Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at `/var/lib/php/sessions`. Such session files are named `sess_[session_value]`, where `[session_value]` is provided to the client in a `Set-Cookie` response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-35939","reference_id":"","reference_type":"","scores":[{"value":"0.33065","scoring_system":"epss","scoring_elements":"0.96979","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-35939"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/commit/e4c7bac8f31010aee048409f9ef6f744a83146b2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/e4c7bac8f31010aee048409f9ef6f744a83146b2"},{"reference_url":"https://github.com/craftcms/cms/pull/17220","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/"}],"url":"https://github.com/craftcms/cms/pull/17220"},{"reference_url":"https://github.com/craftcms/cms/releases/tag/4.15.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/"}],"url":"https://github.com/craftcms/cms/releases/tag/4.15.3"},{"reference_url":"https://github.com/craftcms/cms/releases/tag/5.7.5","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/"}],"url":"https://github.com/craftcms/cms/releases/tag/5.7.5"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-35939","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-35939"},{"reference_url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/"}],"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939"},{"reference_url":"https://www.cve.org/CVERecord?id=CVE-2025-35939","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:H"},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-06-06T03:55:25Z/"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-05-07T22:40:17Z/"}],"url":"https://www.cve.org/CVERecord?id=CVE-2025-35939"},{"reference_url":"https://github.com/advisories/GHSA-7vrx-9684-xrf2","reference_id":"GHSA-7vrx-9684-xrf2","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-7vrx-9684-xrf2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/66587?format=json","purl":"pkg:composer/craftcms/cms@4.15.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-87ph-sj86-suda"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-9ugq-3rbm-4udf"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-b1uf-z4ky-2khz"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-j4pa-83uz-5kdh"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-n9cs-ku91-5qbw"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.15.3"},{"url":"http://public2.vulnerablecode.io/api/packages/66585?format=json","purl":"pkg:composer/craftcms/cms@5.7.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-83ez-6ug2-zuct"},{"vulnerability":"VCID-87ph-sj86-suda"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-9ugq-3rbm-4udf"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-b1uf-z4ky-2khz"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-eqbz-rshf-s7f8"},{"vulnerability":"VCID-f4uq-8yjx-jqg7"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-j4pa-83uz-5kdh"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-mf8b-q9jr-u3d8"},{"vulnerability":"VCID-n9cs-ku91-5qbw"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-r2be-9kxn-vfhk"},{"vulnerability":"VCID-sm6s-cv6r-67dj"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xe2n-79vz-x7d1"},{"vulnerability":"VCID-z5ds-yx3v-b7gz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.7.5"}],"aliases":["CVE-2025-35939","GHSA-7vrx-9684-xrf2"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1q7e-qqs4-1kfu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/50343?format=json","vulnerability_id":"VCID-1t9v-xx59-3kbt","summary":"Craft CMS discloses password hashes\nAll Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-37783","reference_id":"","reference_type":"","scores":[{"value":"0.01396","scoring_system":"epss","scoring_elements":"0.80704","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-37783"},{"reference_url":"https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes"},{"reference_url":"https://cves.at/posts/cve-2022-37783/writeup","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cves.at/posts/cve-2022-37783/writeup"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37783","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37783"},{"reference_url":"http://www.openwall.com/lists/oss-security/2024/06/06/1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T17:33:05Z/"}],"url":"http://www.openwall.com/lists/oss-security/2024/06/06/1"},{"reference_url":"https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes/","reference_id":"cve-disclosure-of-password-hashes","reference_type":"","scores":[{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T17:33:05Z/"}],"url":"https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes/"},{"reference_url":"https://github.com/advisories/GHSA-h972-v458-m892","reference_id":"GHSA-h972-v458-m892","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h972-v458-m892"},{"reference_url":"https://cves.at/posts/cve-2022-37783/writeup/","reference_id":"writeup","reference_type":"","scores":[{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T17:33:05Z/"}],"url":"https://cves.at/posts/cve-2022-37783/writeup/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/86498?format=json","purl":"pkg:composer/craftcms/cms@3.7.33","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.33"}],"aliases":["CVE-2022-37783","GHSA-h972-v458-m892"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1t9v-xx59-3kbt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/58534?format=json","vulnerability_id":"VCID-33kt-q7wn-xfcx","summary":"Improper account password reset in Craft CMS\nCraft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).","references":[{"reference_url":"http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29933","reference_id":"","reference_type":"","scores":[{"value":"0.02319","scoring_system":"epss","scoring_elements":"0.85052","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29933"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29933","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29933"},{"reference_url":"https://sec-consult.com/vulnerability-lab","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://sec-consult.com/vulnerability-lab"},{"reference_url":"https://sec-consult.com/vulnerability-lab/","reference_id":"","reference_type":"","scores":[],"url":"https://sec-consult.com/vulnerability-lab/"},{"reference_url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms"},{"reference_url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms/","reference_id":"","reference_type":"","scores":[],"url":"https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms/"},{"reference_url":"https://github.com/advisories/GHSA-5cjr-78cq-3wrg","reference_id":"GHSA-5cjr-78cq-3wrg","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5cjr-78cq-3wrg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/141054?format=json","purl":"pkg:composer/craftcms/cms@3.7.36","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-33kt-q7wn-xfcx"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.36"},{"url":"http://public2.vulnerablecode.io/api/packages/371680?format=json","purl":"pkg:composer/craftcms/cms@3.7.37","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.37"}],"aliases":["CVE-2022-29933","GHSA-5cjr-78cq-3wrg"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-33kt-q7wn-xfcx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39255?format=json","vulnerability_id":"VCID-3quv-68nd-tffm","summary":"craftcms/cms vulnerable to cross site scripting in RSS feed widget\nA malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in [this commit](https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442).","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-31144","reference_id":"","reference_type":"","scores":[{"value":"0.00669","scoring_system":"epss","scoring_elements":"0.71642","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-31144"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-28T16:40:35Z/"}],"url":"https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442"},{"reference_url":"https://github.com/craftcms/cms/commit/e2f7e7b7d86a0afa54ce855375d13c7760670764","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/e2f7e7b7d86a0afa54ce855375d13c7760670764"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-28T16:40:35Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31144","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31144"},{"reference_url":"https://github.com/advisories/GHSA-j4mx-98hw-6rv6","reference_id":"GHSA-j4mx-98hw-6rv6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-j4mx-98hw-6rv6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/73045?format=json","purl":"pkg:composer/craftcms/cms@3.8.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.8.4"},{"url":"http://public2.vulnerablecode.io/api/packages/73046?format=json","purl":"pkg:composer/craftcms/cms@4.4.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2ymm-azyw-uqeh"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-65ts-4phh-n7gd"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jgq1-awz5-kfdg"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-p4db-a4kx-xygp"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-tb6n-63a7-dbad"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xdt7-3a51-h7ae"},{"vulnerability":"VCID-xe2n-79vz-x7d1"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.4"}],"aliases":["CVE-2023-31144","GHSA-j4mx-98hw-6rv6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3quv-68nd-tffm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35250?format=json","vulnerability_id":"VCID-3vpa-gdjd-qyek","summary":"Cross Site Scripting in CraftCMS\nCraftCMS prior to version 3.7.68 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30177","reference_id":"","reference_type":"","scores":[{"value":"0.00338","scoring_system":"epss","scoring_elements":"0.56806","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30177"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:24:49Z/"}],"url":"https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30177","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30177"},{"reference_url":"https://github.com/advisories/GHSA-wv7j-rc2q-9j67","reference_id":"GHSA-wv7j-rc2q-9j67","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-wv7j-rc2q-9j67"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67368?format=json","purl":"pkg:composer/craftcms/cms@3.7.68","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.68"}],"aliases":["CVE-2023-30177","GHSA-wv7j-rc2q-9j67"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3vpa-gdjd-qyek"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38966?format=json","vulnerability_id":"VCID-4trj-3bzn-23b2","summary":"Craft CMS vulnerable to HTML injection\nCraft CMS through 4.4.9 is vulnerable to HTML Injection.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33495","reference_id":"","reference_type":"","scores":[{"value":"0.00168","scoring_system":"epss","scoring_elements":"0.37724","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33495"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33495","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33495"},{"reference_url":"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-09T21:12:01Z/"}],"url":"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection"},{"reference_url":"https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212","reference_id":"html-injection-in-craft-cms-application-e2b28f746212","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-09T21:12:01Z/"}],"url":"https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/372955?format=json","purl":"pkg:composer/craftcms/cms@4.4.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2ymm-azyw-uqeh"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jgq1-awz5-kfdg"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xdt7-3a51-h7ae"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.10"}],"aliases":["CVE-2023-33495","GHSA-m3v5-gjj9-rg24"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4trj-3bzn-23b2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56098?format=json","vulnerability_id":"VCID-53zg-p8rb-hbcd","summary":"SEOmatic for CraftCMS allows Server-Side Template Injection\nThe Seomatic component before 3.2.46 for Craft CMS allows Server-Side Template Injection and information disclosure via malformed data to the metacontainers controller.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9757","reference_id":"","reference_type":"","scores":[{"value":"0.94276","scoring_system":"epss","scoring_elements":"0.9994","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9757"},{"reference_url":"https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt"},{"reference_url":"https://github.com/nystudio107/craft-seomatic","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic"},{"reference_url":"https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md"},{"reference_url":"https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b"},{"reference_url":"https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9757","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9757"},{"reference_url":"https://github.com/advisories/GHSA-6q4j-8pjm-5mgc","reference_id":"GHSA-6q4j-8pjm-5mgc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-6q4j-8pjm-5mgc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/442632?format=json","purl":"pkg:composer/craftcms/cms@3.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-1t9v-xx59-3kbt"},{"vulnerability":"VCID-33kt-q7wn-xfcx"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-57ef-4sad-pqd1"},{"vulnerability":"VCID-6fax-mk6f-pkaf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-e298-cj31-mkc7"},{"vulnerability":"VCID-eq4r-utjw-27fd"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-gta9-tbst-nqdp"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-rz2b-6djb-u7ar"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-vjxt-tfby-nugg"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.3.0"}],"aliases":["CVE-2020-9757","GHSA-6q4j-8pjm-5mgc"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-53zg-p8rb-hbcd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/51499?format=json","vulnerability_id":"VCID-57ef-4sad-pqd1","summary":"Craft CMS Cross-site Scripting Vulnerability\nCraft CMS before 3.6.13 has an XSS vulnerability.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-32470","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56006","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-32470"},{"reference_url":"https://github.com/craftcms/cms/blob/3.6.13/CHANGELOG.md#security","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/3.6.13/CHANGELOG.md#security"},{"reference_url":"https://github.com/craftcms/cms/commit/f9378aa154b5f9b64bed3d59cce0c4a8184bf5e6","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/f9378aa154b5f9b64bed3d59cce0c4a8184bf5e6"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32470","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32470"},{"reference_url":"https://github.com/advisories/GHSA-h2rj-8wgg-mm43","reference_id":"GHSA-h2rj-8wgg-mm43","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h2rj-8wgg-mm43"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/87793?format=json","purl":"pkg:composer/craftcms/cms@3.6.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-1t9v-xx59-3kbt"},{"vulnerability":"VCID-33kt-q7wn-xfcx"},{"vulnerability":"VCID-3eqd-vgat-pbc6"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-gta9-tbst-nqdp"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-rz2b-6djb-u7ar"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-vjxt-tfby-nugg"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.13"}],"aliases":["CVE-2021-32470","GHSA-h2rj-8wgg-mm43"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-57ef-4sad-pqd1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/58178?format=json","vulnerability_id":"VCID-6fax-mk6f-pkaf","summary":"Craft CMS XSS Vulnerability\nCraft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-17496","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56006","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-17496"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09"},{"reference_url":"https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17496","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17496"},{"reference_url":"https://github.com/advisories/GHSA-f3xr-q258-h7m9","reference_id":"GHSA-f3xr-q258-h7m9","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-f3xr-q258-h7m9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/137145?format=json","purl":"pkg:composer/craftcms/cms@3.3.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-1t9v-xx59-3kbt"},{"vulnerability":"VCID-33kt-q7wn-xfcx"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-57ef-4sad-pqd1"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-e298-cj31-mkc7"},{"vulnerability":"VCID-eq4r-utjw-27fd"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-gta9-tbst-nqdp"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-rz2b-6djb-u7ar"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-vjxt-tfby-nugg"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.3.8"}],"aliases":["CVE-2019-17496","GHSA-f3xr-q258-h7m9"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6fax-mk6f-pkaf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/55247?format=json","vulnerability_id":"VCID-9dc9-np3t-pfdr","summary":"Craft CMS XSS Vulnerability\nCraft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-12823","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56006","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-12823"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/6432eca59b93bcea2ca2616199e5d419447e613f/CHANGELOG-v3.md","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/6432eca59b93bcea2ca2616199e5d419447e613f/CHANGELOG-v3.md"},{"reference_url":"https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12823","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12823"},{"reference_url":"https://github.com/advisories/GHSA-w5q4-q7wp-qww6","reference_id":"GHSA-w5q4-q7wp-qww6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-w5q4-q7wp-qww6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/112106?format=json","purl":"pkg:composer/craftcms/cms@3.1.31","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-1t9v-xx59-3kbt"},{"vulnerability":"VCID-33kt-q7wn-xfcx"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-53zg-p8rb-hbcd"},{"vulnerability":"VCID-54y7-bnpk-b3d7"},{"vulnerability":"VCID-57ef-4sad-pqd1"},{"vulnerability":"VCID-6fax-mk6f-pkaf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-e298-cj31-mkc7"},{"vulnerability":"VCID-eq4r-utjw-27fd"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-gta9-tbst-nqdp"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-rz2b-6djb-u7ar"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-vjxt-tfby-nugg"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.1.31"}],"aliases":["CVE-2019-12823","GHSA-w5q4-q7wp-qww6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9dc9-np3t-pfdr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37759?format=json","vulnerability_id":"VCID-bkwr-75av-hfc1","summary":"Craft CMS Stored Cross-site Scripting Injection Vulnerability\n### Summary\n_When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the \nadmin dashboard._\n\n\n\n### PoC\n[_Complete instructions, including specific configuration details, to reproduce the vulnerability._](https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4)\n\n### Impact\nTested with the free version of Craft CMS 4.3.6.1","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-23927","reference_id":"","reference_type":"","scores":[{"value":"0.02749","scoring_system":"epss","scoring_elements":"0.8624","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-23927"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:30:35Z/"}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:30:35Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23927","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23927"},{"reference_url":"https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:30:35Z/"}],"url":"https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4"},{"reference_url":"https://github.com/advisories/GHSA-qcrj-6ffc-v7hq","reference_id":"GHSA-qcrj-6ffc-v7hq","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-qcrj-6ffc-v7hq"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70677?format=json","purl":"pkg:composer/craftcms/cms@3.7.64","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.64"},{"url":"http://public2.vulnerablecode.io/api/packages/70676?format=json","purl":"pkg:composer/craftcms/cms@4.3.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2ymm-azyw-uqeh"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-65ts-4phh-n7gd"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-jgq1-awz5-kfdg"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-p4db-a4kx-xygp"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-tb6n-63a7-dbad"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xdt7-3a51-h7ae"},{"vulnerability":"VCID-xe2n-79vz-x7d1"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.3.7"}],"aliases":["CVE-2023-23927","GHSA-qcrj-6ffc-v7hq"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bkwr-75av-hfc1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/44619?format=json","vulnerability_id":"VCID-e298-cj31-mkc7","summary":"Craft CMS Remote Code Injection\nAn issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27903","reference_id":"","reference_type":"","scores":[{"value":"0.03824","scoring_system":"epss","scoring_elements":"0.88329","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27903"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security"},{"reference_url":"https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27903","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27903"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/78501?format=json","purl":"pkg:composer/craftcms/cms@3.6.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-1t9v-xx59-3kbt"},{"vulnerability":"VCID-33kt-q7wn-xfcx"},{"vulnerability":"VCID-3eqd-vgat-pbc6"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-57ef-4sad-pqd1"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-gta9-tbst-nqdp"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-rz2b-6djb-u7ar"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-vjxt-tfby-nugg"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.7"}],"aliases":["CVE-2021-27903","GHSA-x2j7-6hxm-87p3"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-e298-cj31-mkc7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/44686?format=json","vulnerability_id":"VCID-eq4r-utjw-27fd","summary":"Craft CMS Cross-site Scripting Vulnerability\nAn issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27902","reference_id":"","reference_type":"","scores":[{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.62168","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27902"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1"},{"reference_url":"https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27902","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27902"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/78551?format=json","purl":"pkg:composer/craftcms/cms@3.6.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-1t9v-xx59-3kbt"},{"vulnerability":"VCID-33kt-q7wn-xfcx"},{"vulnerability":"VCID-3eqd-vgat-pbc6"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-57ef-4sad-pqd1"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-e298-cj31-mkc7"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-gta9-tbst-nqdp"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-rz2b-6djb-u7ar"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-vjxt-tfby-nugg"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.6.0"}],"aliases":["CVE-2021-27902","GHSA-3jxh-789f-p7m6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-eq4r-utjw-27fd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39084?format=json","vulnerability_id":"VCID-fmrp-n9qf-zueg","summary":"Stored cross site scripting in Craft CMS\nA post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively. This issue was patched in version 4.4.12.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-2817","reference_id":"","reference_type":"","scores":[{"value":"0.00339","scoring_system":"epss","scoring_elements":"0.56897","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-2817"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T15:47:46Z/"}],"url":"https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2817","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2817"},{"reference_url":"https://www.tenable.com/security/research/tra-2023-20","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.tenable.com/security/research/tra-2023-20"},{"reference_url":"https://www.tenable.com/security/research/tra-2023-20,","reference_id":"","reference_type":"","scores":[],"url":"https://www.tenable.com/security/research/tra-2023-20,"},{"reference_url":"https://www.tenable.com/security/research/tra-2023-20%2C","reference_id":"tra-2023-20%2C","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-15T15:47:46Z/"}],"url":"https://www.tenable.com/security/research/tra-2023-20%2C"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/72392?format=json","purl":"pkg:composer/craftcms/cms@4.4.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2ymm-azyw-uqeh"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jgq1-awz5-kfdg"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xdt7-3a51-h7ae"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.12"}],"aliases":["CVE-2023-2817","GHSA-7x94-jx75-3gh6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fmrp-n9qf-zueg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39143?format=json","vulnerability_id":"VCID-gp75-hsb4-5bbd","summary":"CraftCMS stored XSS in Quick Post widget error message\n### Summary\nThe platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.\n\n### Details\nOld CVE fixed the XSS in label HTML but didn’t fix it when clicking save.\n\n### PoC\n1. Login at admin\n2. Go to setting\n3. Create a Section\n4. On Entry page, click Edit label\n5. Inject the XSS payload into the label and save\n6. On the admin dashboard choose new widget -> Quick Post\n7. In Quick Post, click save with blank slug; The XSS will be executed\n\n    \"errors\":{\"title\":[\"<script>alert('nono')</script> cannot be blank.\"],\"slug\":[\"Slug cannot be blank.\"]\n\nFixed in https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33194","reference_id":"","reference_type":"","scores":[{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19539","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33194"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:25:03Z/"}],"url":"https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888"},{"reference_url":"https://github.com/craftcms/cms/releases/tag/4.4.6","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:25:03Z/"}],"url":"https://github.com/craftcms/cms/releases/tag/4.4.6"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:25:03Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33194","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33194"},{"reference_url":"https://github.com/advisories/GHSA-3wxg-w96j-8hq9","reference_id":"GHSA-3wxg-w96j-8hq9","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3wxg-w96j-8hq9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/72460?format=json","purl":"pkg:composer/craftcms/cms@3.8.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.8.6"},{"url":"http://public2.vulnerablecode.io/api/packages/72458?format=json","purl":"pkg:composer/craftcms/cms@4.4.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2ymm-azyw-uqeh"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-65ts-4phh-n7gd"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jgq1-awz5-kfdg"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xdt7-3a51-h7ae"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.6"}],"aliases":["CVE-2023-33194","GHSA-3wxg-w96j-8hq9"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gp75-hsb4-5bbd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/49148?format=json","vulnerability_id":"VCID-gta9-tbst-nqdp","summary":"Cross-site Scripting in craftcms/cms\nCraft CMS before 3.7.29 allows cross-site scripting.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-28378","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56006","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-28378"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18"},{"reference_url":"https://github.com/craftcms/cms/commit/7ca2b2d2ccecfb524525afc8ceac6f6e44f84b88","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/commit/7ca2b2d2ccecfb524525afc8ceac6f6e44f84b88"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28378","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28378"},{"reference_url":"https://github.com/advisories/GHSA-7xj5-fwqr-5378","reference_id":"GHSA-7xj5-fwqr-5378","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7xj5-fwqr-5378"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/85031?format=json","purl":"pkg:composer/craftcms/cms@3.7.29","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-1t9v-xx59-3kbt"},{"vulnerability":"VCID-33kt-q7wn-xfcx"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-rz2b-6djb-u7ar"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.29"}],"aliases":["CVE-2022-28378","GHSA-7xj5-fwqr-5378"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gta9-tbst-nqdp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/18478?format=json","vulnerability_id":"VCID-hz8p-t48a-wfcr","summary":"Unauthenticated Craft CMS users can trigger a database backup\nUnauthenticated users can trigger database backup operations the `updater/backup` action, potentially leading to resource exhaustion or information disclosure.\n\nUsers should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.\n\nCraft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.\n\nReferences:\n\nhttps://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39\n\nhttps://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04\n\n## Affected Endpoints\n\n- `POST /admin/actions/updater/backup` (unauthenticated)\n\n## Vulnerability Details\n\n### Root Cause\nAll `updater/*` actions are explicitly configured with anonymous access:\n\n```php\n// BaseUpdaterController.php  \nprotected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE;\n```\n\n### Attack Vector\n1. Send unauthenticated POST request to `/admin/actions/updater/backup`\n2. Database backup executes with configured `backupCommand`","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68456","reference_id":"","reference_type":"","scores":[{"value":"0.00219","scoring_system":"epss","scoring_elements":"0.44578","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68456"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04","reference_id":"","reference_type":"","scores":[{"value":"7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"},{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-06T14:26:08Z/"}],"url":"https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04"},{"reference_url":"https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39","reference_id":"","reference_type":"","scores":[{"value":"7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"},{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-06T14:26:08Z/"}],"url":"https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"},{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-06T14:26:08Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68456","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68456"},{"reference_url":"https://github.com/advisories/GHSA-v64r-7wg9-23pr","reference_id":"GHSA-v64r-7wg9-23pr","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v64r-7wg9-23pr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52653?format=json","purl":"pkg:composer/craftcms/cms@4.16.17","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-87ph-sj86-suda"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-9ugq-3rbm-4udf"},{"vulnerability":"VCID-b1uf-z4ky-2khz"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-j4pa-83uz-5kdh"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.16.17"},{"url":"http://public2.vulnerablecode.io/api/packages/52644?format=json","purl":"pkg:composer/craftcms/cms@5.8.21","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-83ez-6ug2-zuct"},{"vulnerability":"VCID-87ph-sj86-suda"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-9ugq-3rbm-4udf"},{"vulnerability":"VCID-b1uf-z4ky-2khz"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-eqbz-rshf-s7f8"},{"vulnerability":"VCID-f4uq-8yjx-jqg7"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-j4pa-83uz-5kdh"},{"vulnerability":"VCID-mf8b-q9jr-u3d8"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-r2be-9kxn-vfhk"},{"vulnerability":"VCID-sm6s-cv6r-67dj"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xe2n-79vz-x7d1"},{"vulnerability":"VCID-z5ds-yx3v-b7gz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.8.21"}],"aliases":["CVE-2025-68456","GHSA-v64r-7wg9-23pr"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hz8p-t48a-wfcr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39001?format=json","vulnerability_id":"VCID-jf19-y3cg-quhq","summary":"Withdrawn Advisory: CraftCMS Server-Side Template Injection vulnerability\n## Withdrawn\nThis advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references.\n\n[According to maintainers of Craft CMS](https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200), only administrators can access Settings, and those administrators may have business needs for their permissions. Additionally, the underlying issue likely has little to no real-world security impact.\n\n## Original Description\nCraftCMS is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30179","reference_id":"","reference_type":"","scores":[{"value":"0.05499","scoring_system":"epss","scoring_elements":"0.90363","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30179"},{"reference_url":"https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/"}],"url":"https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/"}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14"},{"reference_url":"https://github.com/github/advisory-database/pull/2443","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/github/advisory-database/pull/2443"},{"reference_url":"https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/"}],"url":"https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714"},{"reference_url":"https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/"}],"url":"https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30179","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30179"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/72303?format=json","purl":"pkg:composer/craftcms/cms@4.4.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2ymm-azyw-uqeh"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-65ts-4phh-n7gd"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jgq1-awz5-kfdg"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-p4db-a4kx-xygp"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-tb6n-63a7-dbad"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xdt7-3a51-h7ae"},{"vulnerability":"VCID-xe2n-79vz-x7d1"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.2"}],"aliases":["CVE-2023-30179","GHSA-3x74-v64j-qc3f"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jf19-y3cg-quhq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/28341?format=json","vulnerability_id":"VCID-njr7-bmsf-rqcn","summary":"Craft CMS Allows Remote Code Execution\n### Impact\n\nThis is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g\n\nThis is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version. \n\n### Details\n\nhttps://craftcms.com/knowledge-base/craft-cms-cve-2025-32432\n\n### References\n\nhttps://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47\n\nhttps://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical\nhttps://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical\nhttps://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical\n\nhttps://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/\n\n### Credits\n\nCredit to [Orange Cyberdefense](https://github.com/Orange-Cyberdefense) for discovering a reporting this bug.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32432","reference_id":"","reference_type":"","scores":[{"value":"0.92897","scoring_system":"epss","scoring_elements":"0.99777","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32432"},{"reference_url":"https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical","reference_id":"","reference_type":"","scores":[{"value":"10","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-03-20T15:24:23Z/"}],"url":"https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical"},{"reference_url":"https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical","reference_id":"","reference_type":"","scores":[{"value":"10","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-03-20T15:24:23Z/"}],"url":"https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical"},{"reference_url":"https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical","reference_id":"","reference_type":"","scores":[{"value":"10","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-03-20T15:24:23Z/"}],"url":"https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical"},{"reference_url":"https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47","reference_id":"","reference_type":"","scores":[{"value":"10","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-03-20T15:24:23Z/"}],"url":"https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3","reference_id":"","reference_type":"","scores":[{"value":"10","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-03-20T15:24:23Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32432","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32432"},{"reference_url":"https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52525.py","reference_id":"CVE-2025-32432","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52525.py"},{"reference_url":"https://github.com/advisories/GHSA-f3gw-9ww9-jmc3","reference_id":"GHSA-f3gw-9ww9-jmc3","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-f3gw-9ww9-jmc3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61987?format=json","purl":"pkg:composer/craftcms/cms@3.9.15","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-njbc-szad-5fgx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.9.15"},{"url":"http://public2.vulnerablecode.io/api/packages/61988?format=json","purl":"pkg:composer/craftcms/cms@4.14.15","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-9ugq-3rbm-4udf"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-b1uf-z4ky-2khz"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-j4pa-83uz-5kdh"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-n9cs-ku91-5qbw"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.14.15"},{"url":"http://public2.vulnerablecode.io/api/packages/61989?format=json","purl":"pkg:composer/craftcms/cms@5.6.17","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-83ez-6ug2-zuct"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-9ugq-3rbm-4udf"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-b1uf-z4ky-2khz"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-eqbz-rshf-s7f8"},{"vulnerability":"VCID-f4uq-8yjx-jqg7"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-j4pa-83uz-5kdh"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-mf8b-q9jr-u3d8"},{"vulnerability":"VCID-n9cs-ku91-5qbw"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-r2be-9kxn-vfhk"},{"vulnerability":"VCID-sm6s-cv6r-67dj"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xe2n-79vz-x7d1"},{"vulnerability":"VCID-z5ds-yx3v-b7gz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.6.17"}],"aliases":["CVE-2025-32432","GHSA-f3gw-9ww9-jmc3"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-njr7-bmsf-rqcn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9323?format=json","vulnerability_id":"VCID-nswy-bpnq-q7c2","summary":"Craft CMS Feed-Me\nAn issue discovered in Craft CMS version 4.6.1.1 allows remote attackers to cause a denial of service (DoS) via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36260","reference_id":"","reference_type":"","scores":[{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58846","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36260"},{"reference_url":"https://github.com/craftcms/feed-me","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/feed-me"},{"reference_url":"https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-30T16:40:39Z/"}],"url":"https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28"},{"reference_url":"https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-30T16:40:39Z/"}],"url":"https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29"},{"reference_url":"https://github.com/craftcms/feed-me/releases/tag/4.6.2","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/feed-me/releases/tag/4.6.2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36260","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36260"},{"reference_url":"https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-30T16:40:39Z/"}],"url":"https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D"},{"reference_url":"https://github.com/advisories/GHSA-6p78-f7h9-6838","reference_id":"GHSA-6p78-f7h9-6838","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6p78-f7h9-6838"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23299?format=json","purl":"pkg:composer/craftcms/cms@4.6.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.6.2"},{"url":"http://public2.vulnerablecode.io/api/packages/374254?format=json","purl":"pkg:composer/craftcms/cms@4.7.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-9ugq-3rbm-4udf"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-b1uf-z4ky-2khz"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-j4pa-83uz-5kdh"},{"vulnerability":"VCID-jgq1-awz5-kfdg"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xdt7-3a51-h7ae"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.7.0"}],"aliases":["CVE-2023-36260","GHSA-6p78-f7h9-6838"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nswy-bpnq-q7c2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9967?format=json","vulnerability_id":"VCID-p2p9-9qv9-zkft","summary":"Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled\n### Impact\nYou are affected if your php.ini configuration has `register_argc_argv` enabled.\n\n### Patches\nUpdate to 3.9.14, 4.13.2, or 5.5.2.\n\n### Workarounds\nIf you can't upgrade yet, and `register_argc_argv` is enabled, you can disable it to mitigate the issue.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-56145","reference_id":"","reference_type":"","scores":[{"value":"0.93926","scoring_system":"epss","scoring_elements":"0.99886","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-56145"},{"reference_url":"https://github.com/Chocapikk/CVE-2024-56145","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/Chocapikk/CVE-2024-56145"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-06-06T03:55:30Z/"}],"url":"https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-06-06T03:55:30Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56145","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56145"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-56145","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-56145"},{"reference_url":"https://github.com/advisories/GHSA-2p6p-9rc9-62j9","reference_id":"GHSA-2p6p-9rc9-62j9","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-2p6p-9rc9-62j9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/25260?format=json","purl":"pkg:composer/craftcms/cms@3.9.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.9.14"},{"url":"http://public2.vulnerablecode.io/api/packages/25252?format=json","purl":"pkg:composer/craftcms/cms@4.13.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-9ugq-3rbm-4udf"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-b1uf-z4ky-2khz"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-j4pa-83uz-5kdh"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.13.2"},{"url":"http://public2.vulnerablecode.io/api/packages/25246?format=json","purl":"pkg:composer/craftcms/cms@5.5.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-83ez-6ug2-zuct"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-9ugq-3rbm-4udf"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-b1uf-z4ky-2khz"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f4uq-8yjx-jqg7"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-j4pa-83uz-5kdh"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-mf8b-q9jr-u3d8"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xe2n-79vz-x7d1"},{"vulnerability":"VCID-z5ds-yx3v-b7gz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.5.2"}],"aliases":["CVE-2024-56145","GHSA-2p6p-9rc9-62j9"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p2p9-9qv9-zkft"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9329?format=json","vulnerability_id":"VCID-q9wu-u7dc-puhu","summary":"Craft CMS Privilege Escalation\n### Impact\n\nThis is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups.\n\n### Patches\n\nThis has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.\n\n### References\n\nhttps://github.com/craftcms/cms/pull/13932\nhttps://github.com/craftcms/cms/pull/13931\nhttps://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16\nhttps://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21622","reference_id":"","reference_type":"","scores":[{"value":"0.00103","scoring_system":"epss","scoring_elements":"0.27782","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21622"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/"}],"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16"},{"reference_url":"https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/"}],"url":"https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16"},{"reference_url":"https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/"}],"url":"https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa"},{"reference_url":"https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/"}],"url":"https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843"},{"reference_url":"https://github.com/craftcms/cms/pull/13931","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/"}],"url":"https://github.com/craftcms/cms/pull/13931"},{"reference_url":"https://github.com/craftcms/cms/pull/13932","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/"}],"url":"https://github.com/craftcms/cms/pull/13932"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-08T17:11:55Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21622","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21622"},{"reference_url":"https://github.com/advisories/GHSA-j5g9-j7r4-6qvx","reference_id":"GHSA-j5g9-j7r4-6qvx","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-j5g9-j7r4-6qvx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23307?format=json","purl":"pkg:composer/craftcms/cms@3.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/23306?format=json","purl":"pkg:composer/craftcms/cms@4.5.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-9ugq-3rbm-4udf"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-b1uf-z4ky-2khz"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-j4pa-83uz-5kdh"},{"vulnerability":"VCID-jgq1-awz5-kfdg"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xdt7-3a51-h7ae"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.5.11"}],"aliases":["CVE-2024-21622","GHSA-j5g9-j7r4-6qvx"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-q9wu-u7dc-puhu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/13741?format=json","vulnerability_id":"VCID-rz2b-6djb-u7ar","summary":"Craft CMS SQL injection vulnerability via the GraphQL API endpoint\nCraft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37843","reference_id":"","reference_type":"","scores":[{"value":"0.89433","scoring_system":"epss","scoring_elements":"0.99563","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37843"},{"reference_url":"https://blog.smithsecurity.biz/craft-cms-unauthenticated-sqli-via-graphql","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-12T22:53:54Z/"}],"url":"https://blog.smithsecurity.biz/craft-cms-unauthenticated-sqli-via-graphql"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37843","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37843"},{"reference_url":"https://github.com/advisories/GHSA-hq4f-mv3q-8wcv","reference_id":"GHSA-hq4f-mv3q-8wcv","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hq4f-mv3q-8wcv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/325460?format=json","purl":"pkg:composer/craftcms/cms@3.7.32","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-1t9v-xx59-3kbt"},{"vulnerability":"VCID-33kt-q7wn-xfcx"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.32"}],"aliases":["CVE-2024-37843","GHSA-hq4f-mv3q-8wcv"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rz2b-6djb-u7ar"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39233?format=json","vulnerability_id":"VCID-s2mk-kjt5-mbev","summary":"CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter\nAn issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30130","reference_id":"","reference_type":"","scores":[{"value":"0.07135","scoring_system":"epss","scoring_elements":"0.91676","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30130"},{"reference_url":"https://craftcms.com","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://craftcms.com"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30130","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30130"},{"reference_url":"https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-24T16:00:57Z/"}],"url":"https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1"},{"reference_url":"https://craftcms.com/","reference_id":"craftcms.com","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-24T16:00:57Z/"}],"url":"https://craftcms.com/"},{"reference_url":"https://github.com/advisories/GHSA-fjx5-xm7q-whvj","reference_id":"GHSA-fjx5-xm7q-whvj","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-fjx5-xm7q-whvj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/613382?format=json","purl":"pkg:composer/craftcms/cms@3.8.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.8.2"}],"aliases":["CVE-2023-30130","GHSA-fjx5-xm7q-whvj"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-s2mk-kjt5-mbev"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37105?format=json","vulnerability_id":"VCID-uta8-3sq6-kyex","summary":"Craft CMS vulnerable to Remote Code Execution via validatePath bypass\n### Summary\nBypassing the validatePath function can lead to potential Remote Code Execution\n(Post-authentication, ALLOW_ADMIN_CHANGES=true)\n\n### Details\n\nIn bootstrap.php, the SystemPaths path is set as below.\n```php\n// Set the vendor path. By default assume that it's 4 levels up from here\n$vendorPath = $findConfigPath('--vendorPath', 'CRAFT_VENDOR_PATH') ?? dirname(__DIR__, 3);\n\n// Set the \"project root\" path that contains config/, storage/, etc. By default assume that it's up a level from vendor/.\n$rootPath = $findConfigPath('--basePath', 'CRAFT_BASE_PATH') ?? dirname($vendorPath);\n\n// By default the remaining directories will be in the base directory\n$dotenvPath = $findConfigPath('--dotenvPath', 'CRAFT_DOTENV_PATH') ?? \"$rootPath/.env\";\n$configPath = $findConfigPath('--configPath', 'CRAFT_CONFIG_PATH') ?? \"$rootPath/config\";\n$contentMigrationsPath = $findConfigPath('--contentMigrationsPath', 'CRAFT_CONTENT_MIGRATIONS_PATH') ?? \"$rootPath/migrations\";\n$storagePath = $findConfigPath('--storagePath', 'CRAFT_STORAGE_PATH') ?? \"$rootPath/storage\";\n$templatesPath = $findConfigPath('--templatesPath', 'CRAFT_TEMPLATES_PATH') ?? \"$rootPath/templates\";\n$translationsPath = $findConfigPath('--translationsPath', 'CRAFT_TRANSLATIONS_PATH') ?? \"$rootPath/translations\";\n$testsPath = $findConfigPath('--testsPath', 'CRAFT_TESTS_PATH') ?? \"$rootPath/tests\";\n```\n\nBecause paths are validated based on the /path1/path2 format, this can be bypassed using a file URI scheme such as file:///path1/path2. File scheme is supported in mkdir()\n```php\n    /**\n     * @param string $attribute\n     * @param array|null $params\n     * @param InlineValidator $validator\n     * @return void\n     * @since 4.4.6\n     */\n    public function validatePath(string $attribute, ?array $params, InlineValidator $validator): void\n    {\n        // Make sure it’s not within any of the system directories\n        $path = FileHelper::absolutePath($this->getRootPath(), '/');\n\n        $systemDirs = Craft::$app->getPath()->getSystemPaths();\n\n        foreach ($systemDirs as $dir) {\n            $dir = FileHelper::absolutePath($dir, '/');\n            if (str_starts_with(\"$path/\", \"$dir/\")) {\n                $validator->addError($this, $attribute, Craft::t('app', 'Local volumes cannot be located within system directories.'));\n                break;\n            }\n        }\n    }\n```\n\nref. https://www.php.net/manual/en/wrappers.file.php\n\n\n\n### PoC\n1) Create a new filesystem. **Base Path: file:///var/www/html/templates**\n\n![1](https://user-images.githubusercontent.com/30969523/249252853-5cde9bae-9279-428a-972b-d4444c545819.png)\n\n\n2) Create a new asset volume. Asset Filesystem: local_bypass\n\n![2](https://user-images.githubusercontent.com/30969523/249256711-e37da7f8-52d6-4ecc-bfc4-b9b9d8a2230d.png)\n\n\n3) Upload a ttml file with rce template code. Confirm poc.ttml file created in /var/www/html/templates\n```twig\n{{'<pre>'}}\n{{1337*1337}}\n{{['cat /etc/passwd']|map('passthru')|join}}\n{{['id;pwd;ls -altr /']|map('passthru')|join}}\n```\n![3](https://user-images.githubusercontent.com/30969523/249256731-8dafc3dc-4937-4f69-bba0-97bc96be1ada.png)\n![4](https://user-images.githubusercontent.com/30969523/249257369-54e22aff-3919-4a21-b696-a7be74086ff9.png)\n\n\n4) Create a new route. URI: * , Template: poc.ttml\n\n![5](https://user-images.githubusercontent.com/30969523/249257437-972ec725-8197-4472-9b57-750ab91d9bfd.png)\n\n\n5) Confirm RCE on arbitrary path ( /* )\n\n![6](https://user-images.githubusercontent.com/30969523/249257465-061dbaf8-a2c6-4366-80f5-986a15bad748.png)\n\n\n#### PoC Env\n\n![0628 env](https://user-images.githubusercontent.com/30969523/249252784-6e5913ad-9ad1-4d3a-a70f-2c5ff9f55166.png)\n\n\n### Impact\nTake control of vulnerable systems, Data exfiltrations, Malware execution, Pivoting, etc.\n\nalthough the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution)","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-40035","reference_id":"","reference_type":"","scores":[{"value":"0.00308","scoring_system":"epss","scoring_elements":"0.54227","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-40035"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/commit/0bd33861abdc60c93209cff03eeee54504d3d3b5","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-02T20:33:49Z/"}],"url":"https://github.com/craftcms/cms/commit/0bd33861abdc60c93209cff03eeee54504d3d3b5"},{"reference_url":"https://github.com/craftcms/cms/releases/tag/3.8.15","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-02T20:33:49Z/"}],"url":"https://github.com/craftcms/cms/releases/tag/3.8.15"},{"reference_url":"https://github.com/craftcms/cms/releases/tag/4.4.15","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-02T20:33:49Z/"}],"url":"https://github.com/craftcms/cms/releases/tag/4.4.15"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phw","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-02T20:33:49Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phw"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40035","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40035"},{"reference_url":"https://github.com/advisories/GHSA-44wr-rmwq-3phw","reference_id":"GHSA-44wr-rmwq-3phw","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-44wr-rmwq-3phw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69958?format=json","purl":"pkg:composer/craftcms/cms@3.8.15","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.8.15"},{"url":"http://public2.vulnerablecode.io/api/packages/67874?format=json","purl":"pkg:composer/craftcms/cms@4.4.15","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jgq1-awz5-kfdg"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xdt7-3a51-h7ae"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.15"}],"aliases":["CVE-2023-40035","GHSA-44wr-rmwq-3phw"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uta8-3sq6-kyex"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/49108?format=json","vulnerability_id":"VCID-vjxt-tfby-nugg","summary":"XSS Injection Vulnerability\n### Impact\n\nUnder some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied.\n\n### Patches\n\nThis has been patched in Craft 3.7.29.\n\n### References\n\n* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [support@craftcms.com](mailto:support@craftcms.com)\n\n----------\n\nCredits: https://github.com/noobpk","references":[{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-wf98-vxv9-jqfv","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-wf98-vxv9-jqfv"},{"reference_url":"https://github.com/advisories/GHSA-wf98-vxv9-jqfv","reference_id":"GHSA-wf98-vxv9-jqfv","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wf98-vxv9-jqfv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/85031?format=json","purl":"pkg:composer/craftcms/cms@3.7.29","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-1t9v-xx59-3kbt"},{"vulnerability":"VCID-33kt-q7wn-xfcx"},{"vulnerability":"VCID-3quv-68nd-tffm"},{"vulnerability":"VCID-3vpa-gdjd-qyek"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-bkwr-75av-hfc1"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gp75-hsb4-5bbd"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jf19-y3cg-quhq"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-rz2b-6djb-u7ar"},{"vulnerability":"VCID-s2mk-kjt5-mbev"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-yvhk-5p4k-vyfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.7.29"}],"aliases":["GHSA-wf98-vxv9-jqfv","GMS-2022-790"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vjxt-tfby-nugg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39302?format=json","vulnerability_id":"VCID-yvhk-5p4k-vyfm","summary":"Craft CMS stored XSS in indexedVolumes\n### Summary\nXSS can be triggered via the Update Asset Index utility\n\n### PoC\n1. Access setting tab\n2. Create new assets\n3. In assets name inject payload: \"<script>alert(26)</script>\n4. Click Utilities tab\n5. Choose all volumes, or volume trigger xss\n7. Click Update asset indexes.\n\nXSS will be triggered\n\nJson response volumes name makes triggers the payload\n\n    \"session\":{\"id\":1,\"indexedVolumes\":{\"1\":\"\\\"<script>alert(26)</script>\"},\n\nIt’s run on every POST request in the utility.\n\nResolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33197","reference_id":"","reference_type":"","scores":[{"value":"0.00402","scoring_system":"epss","scoring_elements":"0.6109","published_at":"2026-05-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33197"},{"reference_url":"https://github.com/craftcms/cms","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/craftcms/cms"},{"reference_url":"https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:32:08Z/"}],"url":"https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766"},{"reference_url":"https://github.com/craftcms/cms/releases/tag/4.4.6","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:32:08Z/"}],"url":"https://github.com/craftcms/cms/releases/tag/4.4.6"},{"reference_url":"https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-14T19:32:08Z/"}],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33197","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33197"},{"reference_url":"https://github.com/advisories/GHSA-6qjx-787v-6pxr","reference_id":"GHSA-6qjx-787v-6pxr","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-6qjx-787v-6pxr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/72458?format=json","purl":"pkg:composer/craftcms/cms@4.4.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1pz8-3afe-k7br"},{"vulnerability":"VCID-1q7e-qqs4-1kfu"},{"vulnerability":"VCID-2ymm-azyw-uqeh"},{"vulnerability":"VCID-2zhq-6w19-53dj"},{"vulnerability":"VCID-31wd-196j-5khq"},{"vulnerability":"VCID-3pgv-v41d-5udb"},{"vulnerability":"VCID-4c2n-apuy-5fd1"},{"vulnerability":"VCID-4khb-nmvj-gycg"},{"vulnerability":"VCID-4trj-3bzn-23b2"},{"vulnerability":"VCID-4x15-rhvk-13es"},{"vulnerability":"VCID-65ts-4phh-n7gd"},{"vulnerability":"VCID-68s9-2fm9-yucf"},{"vulnerability":"VCID-6cyd-ueky-mbfd"},{"vulnerability":"VCID-75zz-rn62-f7az"},{"vulnerability":"VCID-7dh4-g61z-3yfp"},{"vulnerability":"VCID-8qty-r9f7-zubc"},{"vulnerability":"VCID-9gkm-kypx-zkbr"},{"vulnerability":"VCID-anb6-t3rc-yya4"},{"vulnerability":"VCID-crut-ks5a-23eq"},{"vulnerability":"VCID-dk6t-rgvr-5bf3"},{"vulnerability":"VCID-duad-bytu-fkcf"},{"vulnerability":"VCID-e9qf-n8x1-v3cy"},{"vulnerability":"VCID-f8j8-bvyv-xqb4"},{"vulnerability":"VCID-fhnu-fuz7-2ybf"},{"vulnerability":"VCID-fmrp-n9qf-zueg"},{"vulnerability":"VCID-gah2-66nh-mfea"},{"vulnerability":"VCID-gsfs-jjza-13fb"},{"vulnerability":"VCID-hz8p-t48a-wfcr"},{"vulnerability":"VCID-jgq1-awz5-kfdg"},{"vulnerability":"VCID-jzdk-17bh-9fh2"},{"vulnerability":"VCID-n5ut-tfbe-nyhb"},{"vulnerability":"VCID-njbc-szad-5fgx"},{"vulnerability":"VCID-njr7-bmsf-rqcn"},{"vulnerability":"VCID-nswy-bpnq-q7c2"},{"vulnerability":"VCID-p1ms-xwtp-wfhx"},{"vulnerability":"VCID-p2p9-9qv9-zkft"},{"vulnerability":"VCID-pu4h-q1xa-rueg"},{"vulnerability":"VCID-px9f-g486-fbav"},{"vulnerability":"VCID-q9wu-u7dc-puhu"},{"vulnerability":"VCID-qmbc-e1dx-8fb2"},{"vulnerability":"VCID-su2b-cn41-e3hp"},{"vulnerability":"VCID-ucdg-vdy9-9kba"},{"vulnerability":"VCID-upn1-t3mu-cuc4"},{"vulnerability":"VCID-uta8-3sq6-kyex"},{"vulnerability":"VCID-w6qb-529b-b3fy"},{"vulnerability":"VCID-wsfx-pdk7-cfbn"},{"vulnerability":"VCID-x1ew-wwnd-w7hc"},{"vulnerability":"VCID-x7xw-5e4c-2fh3"},{"vulnerability":"VCID-xdt7-3a51-h7ae"},{"vulnerability":"VCID-xe2n-79vz-x7d1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.4.6"}],"aliases":["CVE-2023-33197","GHSA-6qjx-787v-6pxr"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yvhk-5p4k-vyfm"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.1.28"}