Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

CMS — Vulnerabilities & Security Advisories 321

All 321 CVE vulnerabilities found in CMS, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting Content Management Systems. It collects recorded flaws across multiple CMS vendors, spanning advisories published over the last five years. Readers can track vendor-specific security updates, analyze common weakness classes such as SQL injection and cross-site scripting, and review the historical vulnerability trends for any given product. The data is organized by vendor and weakness type, enabling detailed comparison and trend analysis. No specific CVE identifiers are listed in this overview; the focus remains on patterns, frequencies, and remediation guidance. This resource supports security teams, developers, and IT managers who need to prioritize patches and assess risk exposure across their managed platforms.

Vendor: Mambo

CVE ID Title CVSS Severity Published
CVE-2026-79990 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete CWE-639 8.7 High 2026-09-02
CVE-2026-79989 Arbitrary user password reset leading to administrator account takeover CWE-285 8.7 High 2026-09-02
CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers CWE-862 8.8 High 2026-09-02
CVE-2026-84802 Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController CWE-862 4.3 Medium 2026-09-02
CVE-2026-84800 Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file CWE-862 7.1 High 2026-09-02
CVE-2026-84799 Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations CWE-285 4.3 Medium 2026-09-02
CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite CWE-862 7.1 High 2026-09-02
CVE-2026-84797 Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate CWE-862 6.3 Medium 2026-09-02
CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass CWE-639 8.8 High 2026-09-02
CVE-2026-84795 Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance CWE-269 9.8 Critical 2026-09-02
CVE-2026-84794 Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset CWE-862 7.1 High 2026-09-02
CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name CWE-79 4.8 Medium 2026-09-02
CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes CWE-862 4.3 Medium 2026-09-02
CVE-2026-79988 Authenticated RCE through Twig sandbox escape CWE-693 8.7 High 2026-08-27
CVE-2026-78416 Authenticated RCE via `condition.config` JSON cleanse bypass CWE-915 8.7 High 2026-08-24
CVE-2026-19975 Azuriom CMS Money Transfer ProfileController.php transferMoney toctou CWE-367 3.1 Low 2026-08-17
CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name CWE-79 6.4 Medium 2026-08-12
CVE-2026-72786 Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset CWE-285 6.5 Medium 2026-08-12
CVE-2026-72785 Craft CMS before 5.10.6 Authorization Bypass via structures/move-element CWE-863 4.3 Medium 2026-08-11
CVE-2026-72784 Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation CWE-918 5.4 Medium 2026-08-11
CVE-2026-72783 Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained CWE-22 6.2 Medium 2026-08-11
CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak CWE-668 6.5 Medium 2026-08-11
CVE-2026-72781 Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape CWE-693 8.8 High 2026-08-11
CVE-2026-72780 Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey CWE-294 6.5 Medium 2026-08-11
CVE-2026-72779 Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject CWE-184 4.5 Medium 2026-08-11
CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config CWE-915 8.8 High 2026-08-11
CVE-2026-71435 Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template CWE-79 6.1 Medium 2026-08-06
CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types CWE-434 5.3 Medium 2026-08-06
CVE-2026-64662 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries CWE-639 6.5 Medium 2026-08-06
CVE-2026-64663 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction CWE-470 6.5 Medium 2026-08-06

All 321 known CVE vulnerabilities affecting CMS with full Chinese analysis, references, and POCs where available.