CR
Vendor
Craftercms
28
CVEs
0
On KEV
0
New 30D
Products
CC9.8
Crafter Cms
Craftercms
21 CVEs0 on KEV0 new
CR9.1
CrafterCMS
CrafterCMS
5 CVEs0 on KEV0 new
ST7.2
Studio
Craftercms
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-1770 | CR CrafterCMS CrafterCMS | 4.5 | Feb 2 | Improper Control of Dynamically-Managed Code Resources in Crafter Studio |
| CVE-2025-6384 | CR CrafterCMS CrafterCMS | 9.1 | Jun 19 | Improper Control of Dynamically-Managed Code Resources in Crafter Studio |
| CVE-2025-0502 | CR Craftercms Craftercms | 9.1 | Jan 15 | Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing,… |
| CVE-2023-4136 | CR Craftercms Craftercms | 6.1 | Aug 3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected… |
| CVE-2023-33194 | CR Craftercms Craftercms | 4.8 | May 26 | Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an… |
| CVE-2023-26020 | CC Crafter Cms Craftercms | 7.2 | Feb 17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL… |
| CVE-2022-40635 | CC Crafter Cms Craftercms | 7.2 | Sep 13 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox… |
| CVE-2022-40634 | CC Crafter Cms Craftercms | 7.2 | Sep 13 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI |
| CVE-2021-23267 | CC Crafter Cms Craftercms | 8.8 | May 16 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static… |
| CVE-2021-23266 | CC Crafter Cms Craftercms | 4.3 | May 16 | An anonymous user can craft a URL with text that ends up in the log viewer as is |
| CVE-2021-23265 | CC Crafter Cms Craftercms | 4.3 | May 16 | A logged-in and authenticated user with a Reviewer Role may lock a content item |
| CVE-2021-23264 | CC Crafter Cms Craftercms | 9.1 | Dec 2 | Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes |
| CVE-2021-23263 | CC Crafter Cms Craftercms | 7.5 | Dec 2 | Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary) |
| CVE-2021-23262 | CC Crafter Cms Craftercms | 7.2 | Dec 2 | Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE |
| CVE-2021-23261 | CC Crafter Cms Craftercms | 4.9 | Dec 2 | Authenticated administrators may override the system configuration file and cause a denial of service |
| CVE-2021-23260 | CC Crafter Cms Craftercms | 5.4 | Dec 2 | Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site |
| CVE-2021-23259 | CC Crafter Cms Craftercms | 7.2 | Dec 2 | Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage |
| CVE-2021-23258 | CC Crafter Cms Craftercms | 7.2 | Dec 2 | Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans |
| CVE-2017-15686 | CC Crafter Cms Craftercms | 6.1 | Nov 27 | Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies |
| CVE-2017-15685 | CC Crafter Cms Craftercms | 8.6 | Nov 27 | Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE) |
| CVE-2017-15684 | CC Crafter Cms Craftercms | 7.5 | Nov 27 | Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system |
| CVE-2017-15683 | CC Crafter Cms Craftercms | 8.6 | Nov 27 | In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band |
| CVE-2017-15682 | CC Crafter Cms Craftercms | 6.1 | Nov 27 | In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel |
| CVE-2017-15681 | CC Crafter Cms Craftercms | 9.8 | Nov 27 | In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead… |
| CVE-2017-15680 | CC Crafter Cms Craftercms | 6.5 | Nov 27 | In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data |
| CVE-2020-25803 | ST Studio Craftercms | 7.2 | Oct 6 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker… |
| CVE-2020-25802 | ST Studio Craftercms | 7.2 | Oct 6 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting |
| CVE-2018-19907 | CC Crafter Cms Craftercms | 8.8 | Dec 6 | A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18 |