Read the docs

Crafter Software

Records28All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high16CVSS 7.0–8.9

Exploited now

Crafter Software records in CISA KEV

No Crafter Software vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Crafter Cms 21 records MEDIUM Craftercms 4 records MEDIUM Studio 2 records LOW

Records

4 records in Craftercms · all components

TI-2023-16371 CVE-2023-33194 · GHSA-3wxg-w96j-8hq9

CraftCMS stored XSS in Quick Post widget error message

Priority MEDIUM 55

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2023-05-26 Fixed in 4.4.6, 3.8.6 CWE-80
TI-2025-00416 CVE-2025-0502 · GHSA-89xc-2h7r-qc62

Transmission of Private Resources into a New Sphere in Crafter Engine

Priority LOW 37

Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects Cra…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00455 Published 2025-01-15 Fixed in 4.0.8, 4.1.6 CWE-402
TI-2023-03829 CVE-2023-4136 · GHSA-jfm4-3vv3-fm4v

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

Priority LOW 35

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from…

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.0142 Published 2023-08-03 Fixed in 4.0.3, 3.1.28 CWE-79
TI-2025-05785 CVE-2025-6384 · GHSA-5644-3vgq-2ph5

Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Priority LOW 34

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

CVSS 4.0HIGH 7.3 Network High privileges No interaction EPSS 0.00987 Published 2025-06-19 Fixed in 4.3.0 CWE-913
Open these records in search →