Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-1770

Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).

CVSS 4.0 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Craftercms
Products
Crafter Cms Craftercms
CVE-2025-6384

Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Craftercms
Products
Crafter Cms Craftercms
CVE-2025-0502

Transmission of Private Resources into a New Sphere in Crafter Engine

Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects CrafterCMS: from 4.0.0 before 4.0.8, from 4.1.0 before 4.1.6.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Craftercms Linux and 1 more
Products
Macos Craftercms Linux Kernel and 1 more
CVE-2023-4136

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.

CVSS 3.1 · 7.4 High EPSS 1.4% KEV · Not listed
Vendors
Apple Craftercms Linux and 1 more
Products
Macos Craftercms Linux Kernel and 1 more
CVE-2023-33194

CraftCMS stored XSS in Quick Post widget error message

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Craftcms Craftercms
Products
Craft Cms Craftercms