Craftercms
Approved changes feed: RSS · Atom
cpe:2.3:a:craftercms:craftercms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Craftercms (83d6181b-da8f-541c-b1f9-7b016287ca19) |
|---|---|
| Product | Craftercms (eda3be33-5453-5acd-a36d-5633d6e5376d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/craftercms/craftercms |
purl2cpe | 2026-06-01 10:13:32.269353 |
pkg:maven/org.craftercms/craftercms |
purl2cpe | 2026-06-01 10:13:32.269355 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1770 |
vulnerable | 2026-06-08 07:49:09.568925 |
Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).
Published: 2026-02-02T16:16:01.466Z
Updated: 2026-02-02T16:38:59.620Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6384 |
vulnerable | 2026-06-08 07:43:14.957905 |
Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution).
This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
Published: 2025-06-19T20:57:04.714Z
Updated: 2025-06-23T20:22:46.218Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0502 |
vulnerable | 2026-06-08 07:02:24.723329 |
Transmission of Private Resources into a New Sphere in Crafter Engine
Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects CrafterCMS: from 4.0.0 before 4.0.8, from 4.1.0 before 4.1.6.
Published: 2025-01-15T17:47:51.440Z
Updated: 2025-01-15T20:07:34.768Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4136 |
vulnerable | 2026-06-08 06:16:11.577442 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine
HIGH (7.4)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.
Published: 2023-08-03T13:33:10.409Z
Updated: 2025-02-13T17:09:02.003Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-26020 |
vulnerable | 2026-06-08 05:57:37.823237 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Crafter Studio
MEDIUM (5.7)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.
Published: 2023-02-17T17:24:45.089Z
Updated: 2025-03-12T20:05:48.412Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.