CVE-2018-20418
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
Published Updated
PatchFirst · Latest vulnerabilities
craftcms/cms vulnerabilities · Page 7
Vulnerabilities published for craftcms/cms in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 127
CVE-2018-3814
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.
Published UpdatedCVE-2017-9516
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
- Update to 2.6.2982
Published UpdatedCVE-2017-8385
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
- Update to 2.6.2976
Published UpdatedCVE-2017-8384
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.
- Update to 2.6.2976
Published UpdatedCVE-2017-8383
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
- Update to 2.6.2976
Published UpdatedCVE-2017-8052
Craft CMS before 2.6.2974 allows XSS attacks.
- Update to 2.6.2974
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.