[HIGH] Statmic CMS vulnerable to account takeover via XSS and password reset link

PKSA-8pw7-xndm-5j7f CVE-2024-24570 GHSA-vqxq-hvxw-9mv9

Affected version: <3.4.17|>=4.00,<4.46.0

Reported by:
GitHub

[HIGH] Cross-site Scripting via uploaded assets

PKSA-jwp2-xxh9-t8xp CVE-2023-48701 GHSA-8jjh-j3c2-cjcv

Affected version: >=4.0.0,<4.36.0|<3.4.15

Reported by:
GitHub

[HIGH] Statamic CMS vulnerable to remote code execution via form uploads

PKSA-8hch-61s9-d7gd CVE-2023-48217 GHSA-2r53-9295-3m86

Affected version: <3.4.14|>=4.0.0,<4.34.0

Reported by:
GitHub

[HIGH] Statamic CMS remote code execution via front-end form uploads

PKSA-tcb6-sf7c-j9gd CVE-2023-47129 GHSA-72hg-5wr5-rmfc

Affected version: <3.4.13|>=4.0.0,<4.33.0

Reported by:
GitHub

[MEDIUM] Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

PKSA-gfgd-dxd9-46qj CVE-2023-36828 GHSA-6r5g-cq4q-327g

Affected version: <4.10.0

Reported by:
GitHub

[HIGH] Statamic framework Incorrect Permission Assignment

PKSA-4tcv-4gx7-56hm CVE-2017-11422 GHSA-5m64-9hq5-5pf2

Affected version: <2.6.0

Reported by:
GitHub

[LOW] Discoverability of user password hash in Statamic CMS

PKSA-8nyw-p1dz-nqqq CVE-2022-24784 GHSA-qcgx-7p5f-hxvr

Affected version: >=3.3.0,<3.3.2|<3.2.39

Reported by:
GitHub