WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Vendor craftercms✕
Overview 20 matches · 11 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
20matches 11in Waratek scope55.0% 0protected0.0% 1exploited5.0% 0CISA KEV0.0% 1public PoC5.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 5.0% No exploit published 10 50.0% Outside Waratek scope 0 0.0% Not applicable 9 45.0% Withdrawn CVE 0 0.0%
Critical 1 5.0% High 10 50.0% Medium 9 45.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 20 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 5.0% Working exploit published 1 5.0% Proof of concept only 1 5.0% Forecast only 0 0.0% No public exploit 17 85.0%
split by peak 7 / quarter
Not applicable: 9No exploit published: 10Mitigation candidate: 1 Medium: 9High: 10Critical: 1 not blocked: 20 No public exploit: 17Proof of concept only: 1Working exploit published: 1Exploited: 1
Q4 205 No exploit published5 High2 Medium3 not blocked5 No public exploit5 Q1 210 Q2 210 Q3 210 Q4 217 No exploit published1 Not applicable6 Critical1 High4 Medium2 not blocked7 Exploited1 No public exploit6 Q1 220 Q2 223 No exploit published3 High1 Medium2 not blocked3 No public exploit3 Q3 220 Q4 220 Q1 231 Not applicable1 High1 not blocked1 No public exploit1 Q2 231 Not applicable1 Medium1 not blocked1 Proof of concept only1 Q3 231 Mitigation candidate1 High1 not blocked1 Working exploit published1 Q4 230 Q1 240 Q2 240 Q3 240 Q4 240 Q1 251 Not applicable1 Medium1 not blocked1 No public exploit1 Q2 251 No exploit published1 High1 not blocked1 No public exploit1
Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25
20 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-6384 High 2025-06-19 No exploit published No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
CVE-2025-0502 Medium 2025-01-15 Not applicable No public exploit Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects CrafterCMS: from 4.0.0 before 4.0.8, from 4.1.0 before 4.1.6.
CVE-2023-4136 High 2023-08-03 Mitigation candidate Working exploit published Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.
CVE-2023-33194 Medium 2023-05-26 Not applicable Proof of concept only Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
CVE-2023-26020 High 2023-02-17 Not applicable No public exploit Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.
CVE-2021-23267 High 2022-05-16 No exploit published No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.
CVE-2021-23266 Medium 2022-05-16 No exploit published No public exploit An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.
CVE-2021-23265 Medium 2022-05-16 No exploit published No public exploit A logged-in and authenticated user with a Reviewer Role may lock a content item.
CVE-2021-23264 Critical 2021-12-02 No exploit published No public exploit Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
CVE-2021-23263 High 2021-12-02 Not applicable Exploited Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).
CVE-2021-23262 High 2021-12-02 Not applicable No public exploit Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.
CVE-2021-23261 Medium 2021-12-02 Not applicable No public exploit Authenticated administrators may override the system configuration file and cause a denial of service.
CVE-2021-23260 Medium 2021-12-02 Not applicable No public exploit Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
CVE-2021-23259 High 2021-12-02 Not applicable No public exploit Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).
CVE-2021-23258 High 2021-12-02 Not applicable No public exploit Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).
CVE-2017-15686 Medium 2020-11-27 No exploit published No public exploit Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.
CVE-2017-15682 Medium 2020-11-27 No exploit published No public exploit In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.
CVE-2017-15680 Medium 2020-11-27 No exploit published No public exploit In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
CVE-2020-25803 High 2020-10-06 No exploit published No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.
CVE-2020-25802 High 2020-10-06 No exploit published No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.