CMS vulnerabilities

1 known vulnerability in CMS from Craft. None are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 5.3 Medium severity

  Craft CMS External Control of Assumed-Immutable Web Parameter Exploited

  CVE-2025-35939May 7, 2025CraftEPSS 1.37%

  Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and gene