Craft CMS vulnerable to HTML injection

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-33495 · ADVISORY
• craftcms/cms · PACKAGE
• medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212 · WEB
• owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection · WEB
• medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212

More vulnerabilities in craftcms/cms

• CVE-2026-72787MEDIUM 6.4Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered wit…
• CVE-2026-72786MEDIUM 6.5Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users …
• CVE-2026-72785MEDIUM 4.3Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories p…
• CVE-2026-72783MEDIUM 6.2Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePath…
• CVE-2026-72782MEDIUM 6.5Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} s…