Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Crafter CMS 3.1.12 Clear all filters
TI-2021-06000 CVE-2021-23260 · GHSA-h94f-223c-f5mw

Stored XSS Vulnerability in File Name of the File Upload function

Priority LOW 29

Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00444 Published 2021-12-02 Fixed in 3.1.12 CWE-79
TI-2021-05999 CVE-2021-23259 · GHSA-j2hp-qmrf-626c

Groovy Sandbox Bypass

Priority LOW 33

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00727 Published 2021-12-02 Fixed in 3.1.12 CWE-913
TI-2021-05998 CVE-2021-23258 · GHSA-58pg-75f2-3jxj

Spring SPEL Expression Language Injection

Priority LOW 33

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00727 Published 2021-12-02 Fixed in 3.1.12 CWE-913