Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

CMS — Vulnerabilities & Security Advisories 315

All 315 CVE vulnerabilities found in CMS, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting Content Management Systems. It collects recorded flaws across multiple CMS vendors, spanning advisories published over the last five years. Readers can track vendor-specific security updates, analyze common weakness classes such as SQL injection and cross-site scripting, and review the historical vulnerability trends for any given product. The data is organized by vendor and weakness type, enabling detailed comparison and trend analysis. No specific CVE identifiers are listed in this overview; the focus remains on patterns, frequencies, and remediation guidance. This resource supports security teams, developers, and IT managers who need to prioritize patches and assess risk exposure across their managed platforms.

Vendor: Mambo

CVE ID Title CVSS Severity Published
CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite CWE-862 7.1 High 2026-09-02
CVE-2026-84797 Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate CWE-862 6.3 Medium 2026-09-02
CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass CWE-639 8.8 High 2026-09-02
CVE-2026-84794 Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset CWE-862 7.1 High 2026-09-02
CVE-2026-84795 Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance CWE-269 9.8 Critical 2026-09-02
CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name CWE-79 4.8 Medium 2026-09-02
CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes CWE-862 4.3 Medium 2026-09-02
CVE-2026-79988 Authenticated RCE through Twig sandbox escape CWE-693 8.7 High 2026-08-27
CVE-2026-78416 Authenticated RCE via `condition.config` JSON cleanse bypass CWE-915 8.7 High 2026-08-24
CVE-2026-19975 Azuriom CMS Money Transfer ProfileController.php transferMoney toctou CWE-367 3.1 Low 2026-08-17
CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name CWE-79 6.4 Medium 2026-08-12
CVE-2026-72786 Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset CWE-285 6.5 Medium 2026-08-12
CVE-2026-72785 Craft CMS before 5.10.6 Authorization Bypass via structures/move-element CWE-863 4.3 Medium 2026-08-11
CVE-2026-72784 Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation CWE-918 5.4 Medium 2026-08-11
CVE-2026-72783 Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained CWE-22 6.2 Medium 2026-08-11
CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak CWE-668 6.5 Medium 2026-08-11
CVE-2026-72781 Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape CWE-693 8.8 High 2026-08-11
CVE-2026-72780 Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey CWE-294 6.5 Medium 2026-08-11
CVE-2026-72779 Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject CWE-184 4.5 Medium 2026-08-11
CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config CWE-915 8.8 High 2026-08-11
CVE-2026-71435 Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template CWE-79 6.1 Medium 2026-08-06
CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types CWE-434 5.3 Medium 2026-08-06
CVE-2026-64662 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries CWE-639 6.5 Medium 2026-08-06
CVE-2026-64663 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction CWE-470 6.5 Medium 2026-08-06
CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check CWE-287 8.1 High 2026-08-06
CVE-2026-64664 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence CWE-200 4.3 Medium 2026-08-06
CVE-2026-5134 SQLi in Loca Software's CMS CWE-89 9.8 Critical 2026-08-06
CVE-2026-71293 Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable CWE-200 6.2 Medium 2026-08-05
CVE-2026-16219 Croogo CMS Admin File Manager FileManager.php isEditable path traversal CWE-22 6.3 Medium 2026-07-19
CVE-2026-16205 Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting CWE-79 2.4 Low 2026-07-19

All 315 known CVE vulnerabilities affecting CMS with full Chinese analysis, references, and POCs where available.