CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 11/10/2019 |
| CVE-2019-14280 | 보통5.3 | In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public. | 26/07/2019 |
| CVE-2019-12823 | 보통6.1 | Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. | 18/06/2019 |
| CVE-2018-20465 | 높음7.2 | Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be | 25/12/2018 |
| CVE-2018-20418 | 보통4.8 | index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab. | 24/12/2018 |
| CVE-2018-3814 | 높음8.8 | Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension. | 01/01/2018 |
| CVE-2017-9516 | 보통5.4 | Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file. | 08/06/2017 |
| CVE-2017-8385 | 보통5.3 | Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message. | 01/05/2017 |
| CVE-2017-8384 | 보통6.1 | Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052. | 01/05/2017 |
| CVE-2017-8383 | 보통5.3 | Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder. | 01/05/2017 |
| CVE-2017-8052 | 보통6.1 | Craft CMS before 2.6.2974 allows XSS attacks. | 22/04/2017 |