Product by CraftCMS
Craft CMS
97 known vulnerabilities in Craft CMS (CraftCMS), 4 of them actively exploited (CISA KEV).
Key figures
97
Vulnerabilities
4
Actively exploited (KEV)
0
Used by ransomware
13
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-32432 | Craft CMS Allows Remote Code Execution In CISA KEValso in 1 other product | 10.0 | |
| Critical | CVE-2024-56145 | RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms In CISA KEValso in 1 other product | 9.8 | |
| Critical | CVE-2025-23209 | Potential RCE with a compromised security key in craft/cms In CISA KEValso in 1 other product | 8.1 | |
| Critical | CVE-2025-35939 | Craft CMS stores user-provided content in session files In CISA KEValso in 1 other product | 5.3 | |
| Critical | CVE-2026-32267 | CraftCMS CMS: Incorrect Authorization | 9.8 | |
| Critical | CVE-2023-41892 | Craft CMS Remote Code Execution vulnerability | 10.0 | |
| Critical | CVE-2024-37843 | Craft CMS: SQL Injection | 9.8 | |
| Critical | CVE-2020-9757 | Craft CMS: Template Injection | 9.8 | |
| High | CVE-2022-29933 | Craft CMS: security vulnerability | 8.8 | |
| Critical | CVE-2021-27903 | Craft CMS: Remote Code Execution | 9.8 | |
| Medium | CVE-2019-14280 | Craft CMS: security vulnerability | 5.3 | |
| Critical | CVE-2026-28697 | Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates | 9.1 | |
| Critical | CVE-2019-15929 | Craft CMS: security vulnerability | 9.8 | |
| High | CVE-2023-40035 | Craft CMS vulnerable to Remote Code Execution via validatePath bypass | 7.2 | |
| Medium | CVE-2019-9554 | Craft CMS: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2018-3814 | Craft CMS: security vulnerability | 8.8 | |
| High | CVE-2023-30179 | Craft CMS: Template Injection | 7.2 | |
| High | CVE-2026-33157 | Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior | 7.2 | |
| High | CVE-2026-25498 | Craft has a potential authenticated Remote Code Execution via malicious attached Behavior | 7.2 | |
| High | CVE-2025-46731 | Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI | 7.2 | |
| High | CVE-2023-30130 | Craft CMS: Code Execution | 8.8 | |
| High | CVE-2023-32679 | Remote Code Execution via unrestricted file extension in Craft CMS | 7.2 | |
| Medium | CVE-2018-20418 | Craft CMS: Cross-Site Scripting (XSS) | 4.8 | |
| High | CVE-2024-52291 | CraftCMS CMS: Path Traversal | 8.5 | |
| High | CVE-2025-68454 | Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI | 8.8 |