Vulnerabilities

TI-2025-37819 CVE-2025-60790 · GHSA-9p44-q66p-xm6p

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted…

MEDIUM 62

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00433 Published 2025-10-21 No fix listed CWE-400

TI-2024-27686 CVE-2024-41597 · GHSA-r9vw-cjf9-xh4x

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote…

MEDIUM 53

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00212 Published 2024-07-19 No fix listed CWE-352

TI-2023-10250 CVE-2023-24676 · GHSA-2cvg-w29m-j8xc

An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and…

HIGH 67

An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01312 Published 2024-01-24 No fix listed CWE-94

TI-2022-19214 CVE-2022-40488 · GHSA-vpwh-qmwc-2phg

ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).

LOW 29

ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00321 Published 2022-10-31 No fix listed CWE-352

TI-2022-19213 CVE-2022-40487 · GHSA-8g35-prrr-gxxf

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS)…

LOW 30

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00538 Published 2022-10-31 No fix listed CWE-79

TI-2020-16673 CVE-2020-27467 · GHSA-457f-q7w2-wmhh

A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.

MEDIUM 49

A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.1533 Published 2022-02-22 No fix listed CWE-22

Vulnerabilities

Filters

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted…

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote…

An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and…

ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS)…

A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.