Craft CMS Cross-site Scripting (XSS) Vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2018-20418 · ADVISORY
• craftcms/cms · PACKAGE
• rdincel1/Craft-CMS-3.0.25---Cross-Site-Scripting · WEB
• web.archive.org/web/20201208014852/https://www.raifberkaydincel.com/craft-cms-3-0-25-cross-site-scripting-vulnerability.html · WEB
• exploit-db.com/exploits/46054 · WEB
• craftcms/cms · Release Notes
• exploit-db.com/exploits/46054 · Exploit
• raifberkaydincel.com/craft-cms-3-0-25-cross-site-scripting-vulnerability.html · Exploit

craftcms/cms 的其他漏洞

• CVE-2026-72787中危 6.4Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered wit…
• CVE-2026-72786中危 6.5Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users …
• CVE-2026-72785中危 4.3Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories p…
• CVE-2026-72783中危 6.2Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePath…
• CVE-2026-72782中危 6.5Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} s…