Craftercms: >> Crafter Cms Security Vulnerabilities
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.
CVSS Score
5.7
EPSS Score
0.002
Published
2023-02-17
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
CVSS Score
6.4
EPSS Score
0.074
Published
2022-09-13
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
CVSS Score
6.4
EPSS Score
0.039
Published
2022-09-13
A logged-in and authenticated user with a Reviewer Role may lock a content item.
CVSS Score
3.5
EPSS Score
0.004
Published
2022-05-16
An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.
CVSS Score
4.3
EPSS Score
0.002
Published
2022-05-16
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.
CVSS Score
7.6
EPSS Score
0.005
Published
2022-05-16
Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).
CVSS Score
4.2
EPSS Score
0.003
Published
2021-12-02
Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).
CVSS Score
4.2
EPSS Score
0.004
Published
2021-12-02
Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
CVSS Score
6.5
EPSS Score
0.008
Published
2021-12-02
Authenticated administrators may override the system configuration file and cause a denial of service.
CVSS Score
4.5
EPSS Score
0.004
Published
2021-12-02
Page 1