MC
Product
Mura Cms
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 5Medium 1Low 0
Watch
Add Mura Cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-67829 | 9.8 | Mar 18 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection Affected: before 10.1.4 |
| CVE-2025-67830 | 9.8 | Mar 18 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection Affected: before 10.1.4 |
| CVE-2022-47003 | 9.8 | Feb 1 | A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request Affected: before 10.0.580 |
| CVE-2025-55044 | 8.8 | Mar 18 | The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CSRF Affected: All versions, or not specified |
| CVE-2025-55040 | 8.8 | Mar 18 | The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack Affected: All versions, or not specified |
| CVE-2025-55046 | 8.1 | Mar 18 | MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a simple CSRF attack Affected: All versions, or not specified |
| CVE-2025-55041 | 8.0 | Mar 18 | MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate… Affected: All versions, or not specified |
| CVE-2025-55045 | 7.1 | Mar 18 | The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF Affected: All versions, or not specified |
| CVE-2025-55043 | 6.5 | Mar 18 | MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force… Affected: All versions, or not specified |
Showing 9