WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor craftercms✕
Overview 16 matches · 11 in Waratek scope · 6 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
16matches 11in Waratek scope68.8% 6protected37.5% 1exploited6.2% 0CISA KEV0.0% 1public PoC6.2% 0EPSS ≥ 0.50.0%
Protected by Waratek 6 37.5% Rule in development 0 0.0% Mitigation candidate 1 6.2% No exploit published 4 25.0% Outside Waratek scope 0 0.0% Not applicable 5 31.2% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 16 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 6 37.5% partly blocked 0 0.0% not blocked 10 62.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 6.2% Working exploit published 1 6.2% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 14 87.5%
split by peak 5 / year
Not applicable: 5No exploit published: 4Mitigation candidate: 1Protected by Waratek: 6 High: 16 not blocked: 10blocked by ARMR today: 6 No public exploit: 14Working exploit published: 1Exploited: 1
20181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20190 20205 Protected by Waratek3 No exploit published2 High5 blocked by ARMR today3 not blocked2 No public exploit5 20214 Not applicable4 High4 not blocked4 Exploited1 No public exploit3 20223 Protected by Waratek2 No exploit published1 High3 blocked by ARMR today2 not blocked1 No public exploit3 20232 Mitigation candidate1 Not applicable1 High2 not blocked2 Working exploit published1 No public exploit1 20240 20251 No exploit published1 High1 not blocked1 No public exploit1
20182019202020212022202320242025
16 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-6384 High 2025-06-19 No exploit published No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
CVE-2023-4136 High 2023-08-03 Mitigation candidate Working exploit published Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.
CVE-2023-26020 High 2023-02-17 Not applicable No public exploit Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.
CVE-2022-40635 High 2022-09-13 Protected by Waratek No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
CVE-2022-40634 High 2022-09-13 Protected by Waratek No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
CVE-2021-23267 High 2022-05-16 No exploit published No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.
CVE-2021-23263 High 2021-12-02 Not applicable Exploited Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).
CVE-2021-23262 High 2021-12-02 Not applicable No public exploit Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.
CVE-2021-23259 High 2021-12-02 Not applicable No public exploit Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).
CVE-2021-23258 High 2021-12-02 Not applicable No public exploit Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).
CVE-2017-15685 High 2020-11-27 Protected by Waratek No public exploit Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
CVE-2017-15684 High 2020-11-27 Protected by Waratek No public exploit Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.
CVE-2017-15683 High 2020-11-27 Protected by Waratek No public exploit In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
CVE-2020-25803 High 2020-10-06 No exploit published No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.
CVE-2020-25802 High 2020-10-06 No exploit published No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.
CVE-2018-19907 High 2018-12-06 Protected by Waratek No public exploit A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.