Potential RCE with a compromised security key in craft/cms

CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

CraftCMS has an RCE vulnerability via relational conditionals in the control panel

Craft has a GraphQL Asset Mutation Privilege Escalation

Craft has a SQL Injection in Element Indexes via criteria[orderBy]

Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Craft contains a theoretical bypass for CVE-2025-23209

Craft is a content management system

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter

Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a…

Craft CMS before 3.7.14 allows CSV injection

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg…

Craft affected by IDOR via GraphQL @parseRefs

Craft CMS Allows TOTP Token To Stay Valid After Use

An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens

Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

Craft CMS vulnerable to behavior injection RCE via EntryTypesController

Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

Craft Potential Remote Code Execution via Twig SSTI

Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI

Craft is a CMS for creating custom digital experiences on the web and beyond

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI)

Craft CMS is an open source content management system

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for…