Search
Search Results (45 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-14280 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | N/A |
| In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public. | ||||
| CVE-2019-12823 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 6.1 Medium |
| Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. | ||||
| CVE-2018-3814 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | N/A |
| Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension. | ||||
| CVE-2018-20465 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | N/A |
| Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field. | ||||
| CVE-2018-20418 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | N/A |
| index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab. | ||||