Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Crafter Software Component: Craftercms Clear all filters
TI-2025-05785 CVE-2025-6384 · GHSA-5644-3vgq-2ph5

Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Priority LOW 34

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

CVSS 4.0HIGH 7.3 Network High privileges No interaction EPSS 0.00987 Published 2025-06-19 Fixed in 4.3.0 CWE-913
TI-2025-00416 CVE-2025-0502 · GHSA-89xc-2h7r-qc62

Transmission of Private Resources into a New Sphere in Crafter Engine

Priority LOW 37

Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects Cra…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00455 Published 2025-01-15 Fixed in 4.0.8, 4.1.6 CWE-402
TI-2023-03829 CVE-2023-4136 · GHSA-jfm4-3vv3-fm4v

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

Priority LOW 35

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from…

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.0142 Published 2023-08-03 Fixed in 4.0.3, 3.1.28 CWE-79
TI-2023-16371 CVE-2023-33194 · GHSA-3wxg-w96j-8hq9

CraftCMS stored XSS in Quick Post widget error message

Priority MEDIUM 55

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2023-05-26 Fixed in 4.4.6, 3.8.6 CWE-80