crafter

Latest CVEs · RSS

• CVE-2026-1770 2026-02-02 · CVSS 4.5
  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via
• CVE-2025-6384 2025-06-19 · CVSS 7.3
  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via
• CVE-2025-0502 2025-01-15 · CVSS 6.9
  Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Direc
• CVE-2023-4136 2023-08-03 · CVSS 7.4
  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 b
• CVE-2023-26020 2023-02-17 · CVSS 5.7
  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit
• CVE-2022-40635 2022-09-13 · CVSS 6.4
  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via
• CVE-2022-40634 2022-09-13 · CVSS 6.4
  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via
• CVE-2021-23267 2022-05-16 · CVSS 7.6
  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via
• CVE-2021-23266 2022-05-16 · CVSS 4.3
  An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.
• CVE-2021-23265 2022-05-16 · CVSS 3.5
  A logged-in and authenticated user with a Reviewer Role may lock a content item.
• CVE-2021-23264 2021-12-02 · CVSS 8.1
  Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
• CVE-2021-23263 2021-12-02 · CVSS 5.9
  Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).
• CVE-2021-23262 2021-12-02 · CVSS 4.2
  Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.
• CVE-2021-23261 2021-12-02 · CVSS 4.5
  Authenticated administrators may override the system configuration file and cause a denial of service.
• CVE-2021-23260 2021-12-02 · CVSS 6.5
  Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
• CVE-2021-23259 2021-12-02 · CVSS 4.2
  Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script
• CVE-2021-23258 2021-12-02 · CVSS 4.2
  Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security res
• CVE-2020-25803 2020-10-06 · CVSS 4.2
  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via
• CVE-2020-25802 2020-10-06 · CVSS 4.2
  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via