craftcms/cms Security Advisories for 3.7.55.2 (9)
-
[MEDIUM] Craft CMS Feed-Me
PKSA-yq9g-7wmy-ph9w CVE-2023-36260 GHSA-6p78-f7h9-6838
Affected version: <4.6.2
Reported by:
GitHub -
[MEDIUM] Craft CMS Privilege Escalation
PKSA-gcgv-38nz-y8bs CVE-2024-21622 GHSA-j5g9-j7r4-6qvx
Affected version: >=3.0.0,<=3.9.5|>=4.0.0-RC1,<=4.5.10
Reported by:
GitHub -
[HIGH] Craft CMS vulnerable to Remote Code Execution via validatePath bypass
PKSA-cdfq-1syy-3hcn CVE-2023-40035 GHSA-44wr-rmwq-3phw
Affected version: >=3.0.0,<=3.8.14|>=4.0.0-RC1,<=4.4.14
Reported by:
GitHub -
[MEDIUM] Craft CMS vulnerable to HTML injection
PKSA-htxf-m811-km69 CVE-2023-33495 GHSA-m3v5-gjj9-rg24
Affected version: <=4.4.9
Reported by:
GitHub -
[LOW] CraftCMS stored XSS in Quick Post widget error message
PKSA-yhf6-73qh-nrcp CVE-2023-33194 GHSA-3wxg-w96j-8hq9
Affected version: >=3.0.0,<=3.8.5|>=4.0.0-RC1,<4.4.6
Reported by:
GitHub -
[HIGH] CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
PKSA-2kbt-tv7g-v7px CVE-2023-30130 GHSA-fjx5-xm7q-whvj
Affected version: <=3.8.1
Reported by:
GitHub -
[MEDIUM] craftcms/cms vulnerable to cross site scripting in RSS feed widget
PKSA-wgr5-shk8-4nmh CVE-2023-31144 GHSA-j4mx-98hw-6rv6
Affected version: >=4.0.0,<=4.4.3|>=3.0.0,<=3.8.3
Reported by:
GitHub -
[MEDIUM] Cross Site Scripting in CraftCMS
PKSA-t4fh-cwff-qj8q CVE-2023-30177 GHSA-wv7j-rc2q-9j67
Affected version: <3.7.68
Reported by:
GitHub -
[MEDIUM] Craft CMS Stored Cross-site Scripting Injection Vulnerability
PKSA-y2n7-ny47-ym4h CVE-2023-23927 GHSA-qcrj-6ffc-v7hq
Affected version: >=3.7.24,<3.7.64|>=4.0.0-RC1,<4.3.7
Reported by:
GitHub