[ Vendor · 4 CVEs ]
Craft CMS
CVEs affecting Craft CMS published in the last 30 days, plus any Craft CMS CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2025-35939 | 7 May 2025 | CVSS 5.3 | Craft CMS External Control of Assumed-Immutable Web ParameterCraft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an… | ExploitedFix |
| CVE-2025-32432 | 25 Apr 2025 | CVSS 10.0 | Craft CMS Code InjectionCraft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before… | ExploitedFix |
| CVE-2025-23209 | 18 Jan 2025 | CVSS 8.1 | Craft CMS Code InjectionCraft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE)… | ExploitedFix |
| CVE-2024-56145 | 18 Dec 2024 | CVSS 9.8 | Craft CMS Code InjectionCraft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this… | ExploitedFix |